Webhooks Guide

const crypto = require('crypto');
const express = require('express');
const app = express();

const SECRET = process.env.LEADPATTERN_WEBHOOK_SECRET; // whsec_... (or your own secret)
const TOLERANCE_SEC = 300; // reject deliveries signed more than 5 minutes ago

const sign = (data) => 'sha256=' + crypto.createHmac('sha256', SECRET).update(data).digest('hex');

// Constant-time compare that never throws on length mismatch.
function safeEqual(a, b) {
  const ab = Buffer.from(a || '', 'utf8');
  const bb = Buffer.from(b || '', 'utf8');
  return ab.length === bb.length && crypto.timingSafeEqual(ab, bb);
}

// For 24h after you rotate the secret in LeadPattern, deliveries carry a signature made with
// the new secret AND one made with the old secret (*-Previous). Accept a match on either, so
// it doesn't matter whether your receiver has switched to the new secret yet.
const matchesAny = (expected, ...headers) => headers.some((h) => h && safeEqual(h, expected));

// IMPORTANT: verify against the RAW body bytes, before any JSON parsing.
app.post('/leadpattern/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body; // Buffer
  const ts = req.get('X-Webhook-Timestamp');
  let ok = false;

  if (ts && req.get('X-Webhook-Signature-V2')) {
    // V2 (recommended): signature over "<timestamp>.<raw body>" + freshness check
    const fresh = Math.abs(Date.now() / 1000 - Number(ts)) <= TOLERANCE_SEC;
    ok = fresh && matchesAny(
      sign(`${ts}.${raw.toString('utf8')}`),
      req.get('X-Webhook-Signature-V2'),
      req.get('X-Webhook-Signature-V2-Previous'),
    );
  } else {
    // V1: signature over the raw body only
    ok = matchesAny(sign(raw), req.get('X-Webhook-Signature'), req.get('X-Webhook-Signature-Previous'));
  }
  if (!ok) return res.sendStatus(401);

  const payload = JSON.parse(raw.toString('utf8'));
  // Deduplicate on payload.id (== X-Webhook-Id), then hand off to a queue and ACK fast.
  res.sendStatus(200);
});

import hashlib, hmac, json, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ['LEADPATTERN_WEBHOOK_SECRET'].encode()  # whsec_... (or your own secret)
TOLERANCE_SEC = 300  # reject deliveries signed more than 5 minutes ago

def sign(data: bytes) -> str:
    return 'sha256=' + hmac.new(SECRET, data, hashlib.sha256).hexdigest()

def matches_any(expected: str, *headers) -> bool:
    # For 24h after a rotation, deliveries carry signatures from both the new and the
    # previous secret (*-Previous). Accept a match on either.
    return any(h and hmac.compare_digest(h, expected) for h in headers)

@app.route('/leadpattern/webhook', methods=['POST'])
def leadpattern_webhook():
    raw = request.get_data()  # RAW bytes — verify before parsing JSON
    h = request.headers
    ts = h.get('X-Webhook-Timestamp')

    if ts and h.get('X-Webhook-Signature-V2'):
        # V2 (recommended): signature over "<timestamp>.<raw body>" + freshness check
        fresh = abs(time.time() - int(ts)) <= TOLERANCE_SEC
        ok = fresh and matches_any(sign(ts.encode() + b'.' + raw),
                                   h.get('X-Webhook-Signature-V2'), h.get('X-Webhook-Signature-V2-Previous'))
    else:
        # V1: signature over the raw body only
        ok = matches_any(sign(raw), h.get('X-Webhook-Signature'), h.get('X-Webhook-Signature-Previous'))
    if not ok:
        abort(401)

    payload = json.loads(raw)
    # Deduplicate on payload['id'] (== X-Webhook-Id), then queue the work and ACK fast.
    return '', 200

{
  "id": "3f1c2a9e-7b4d-4c1e-9a52-0d6c8e7f1b20",
  "event": "message_received",
  "timestamp": "2026-07-01T10:30:00.000Z",
  "data": {
    "waId": "919999999999",
    "message": {
      "waId": "919999999999",
      "messageId": "wamid.HBgMOTE5OTk5OTk5OTk5FQIAEhgg",
      "direction": "incoming",
      "type": "text",
      "content": {
        "text": {
          "body": "Hi, is the Pro plan available?"
        }
      },
      "status": "received",
      "statusTimestamp": "2026-07-01T10:29:58.000Z",
      "timestamp": "2026-07-01T10:29:58.000Z",
      "replyTo": null
    },
    "contact": {
      "waId": "919999999999",
      "bsuid": null,
      "username": null,
      "name": {
        "first": "Asha",
        "last": "Rao"
      },
      "profileName": "Asha",
      "phone": "9999999999",
      "countryCode": "91",
      "status": "open",
      "optOut": false,
      "assignedTo": {
        "id": "664abc123def456789000001",
        "name": "Ravi (Sales)"
      },
      "tags": [
        {
          "id": "664abc123def456789000aaa",
          "name": "Hot lead",
          "color": "#6366f1"
        }
      ],
      "customAttributes": [
        {
          "slug": "city",
          "value": "Pune"
        },
        {
          "slug": "plan_interest",
          "value": "Pro"
        }
      ]
    },
    "wabaNumber": "919876543210"
  }
}