Webhooks

curl -X POST "$HONCHO_URL/v3/workspaces/my-app/webhooks" \
  -H "Authorization: Bearer $HONCHO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/honcho/webhook"}'

curl -X GET "$HONCHO_URL/v3/workspaces/my-app/webhooks" \
  -H "Authorization: Bearer $HONCHO_API_KEY"

curl -X GET "$HONCHO_URL/v3/workspaces/my-app/webhooks/test" \
  -H "Authorization: Bearer $HONCHO_API_KEY"

curl -X DELETE "$HONCHO_URL/v3/workspaces/my-app/webhooks/$ENDPOINT_ID" \
  -H "Authorization: Bearer $HONCHO_API_KEY"

import hashlib
import hmac
import json
import os

def verify(raw_body: bytes, signature: str) -> bool:
    expected = hmac.new(
        os.environ["WEBHOOK_SECRET"].encode(),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# FastAPI — read the raw body, not a parsed model
@app.post("/honcho/webhook")
async def handle(request: Request):
    raw = await request.body()
    if not verify(raw, request.headers.get("X-Honcho-Signature", "")):
        raise HTTPException(status_code=401)
    event = json.loads(raw)
    ...

import crypto from 'node:crypto';

function verify(rawBody: Buffer, signature: string): boolean {
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET!)
    .update(rawBody)
    .digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express — note express.raw(), not express.json()
app.post('/honcho/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verify(req.body, req.header('X-Honcho-Signature') ?? '')) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body.toString());
  res.sendStatus(200);
});