Webhooks

{
  "id": "evt_123456789",
  "event": "member.created",
  "created_at": "2024-01-15T10:30:00Z",
  "project_id": "proj_abc123",
  "data": {
    // Event-specific data
  }
}

{
  "id": "evt_123456789",
  "event": "member.created",
  "created_at": "2024-01-15T10:30:00Z",
  "project_id": "proj_abc123",
  "data": {
    "id": "mem_xyz789",
    "email": "user@example.com",
    "full_name": "John Doe",
    "plan_id": "free",
    "status": "active",
    "created_at": "2024-01-15T10:30:00Z"
  }
}

{
  "id": "evt_987654321",
  "event": "form.submitted",
  "created_at": "2024-01-15T11:00:00Z",
  "project_id": "proj_abc123",
  "data": {
    "form_id": "form_123",
    "submission_id": "sub_456",
    "fields": {
      "name": "Jane Smith",
      "email": "jane@example.com",
      "message": "Hello!"
    },
    "submitted_at": "2024-01-15T11:00:00Z"
  }
}

X-Gately-Signature: sha256=abc123...

const crypto = require('crypto')

function verifyWebhook(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex')
  
  return `sha256=${expectedSignature}` === signature
}

// Express middleware
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-gately-signature']
  
  if (!verifyWebhook(req.body, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature')
  }
  
  const event = JSON.parse(req.body)
  // Process event...
  
  res.status(200).send('OK')
})

import hmac
import hashlib

def verify_webhook(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    return f"sha256={expected}" == signature

ngrok http 3000