Endpoint Configuration

Verifying Signatures

Every request includes X-Supplo-Signature and X-Supplo-Timestamp headers. Verify like this:

// Node.js example
const crypto = require('crypto');

function verifyWebhook(req, secret) {
  const timestamp = req.headers['x-supplo-timestamp'];
  const signature = req.headers['x-supplo-signature']; // "sha256=..."
  const body = JSON.stringify(req.body);                // raw body string
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(timestamp + '.' + body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

Each event payload has: { event, workspace_id, timestamp, data: {...} }