Webhooks

POST /api/v1/webhooks
Authorization: Bearer <api_key>
Content-Type: application/json

{
  "url": "https://example.com/wadial/webhook",
  "events": ["message.received", "message.receipt", "connection.state"]
}

POST /your/webhook/url
Content-Type: application/json
wadial-event-id: 019f...
wadial-event-type: message.receipt
wadial-signature: t=1782751000,v1=<hex_hmac_sha256>

{
  "id": "019f...",
  "type": "message.receipt",
  "createdAt": "2026-06-29T16:00:00.000Z",
  "sessionId": "019eff5e-e24e-74ce-a9bb-ccd97e6946b6",
  "data": {}
}

<timestamp>.<raw_json_body>

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyWadialSignature({ rawBody, signatureHeader, secret, toleranceSeconds = 300 }) {
  const parts = Object.fromEntries(signatureHeader.split(",").map((part) => part.split("=")));
  const timestamp = Number(parts.t);
  const signature = parts.v1;

  if (!timestamp || !signature) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}