Webhook Verification

clientId|timestamp|POST|/webhooks/liquidramp|{"event":"order.created","data":{...}}

import crypto from "node:crypto";

function verifyWebhook({ rawBody, signature, timestamp, clientId, encryptionKey, path }) {
  const canonical = [clientId, timestamp, "POST", path, rawBody].join("|");
  const expected = "sha256=" + crypto.createHmac("sha256", encryptionKey).update(canonical).digest("hex");

  if (signature.length !== expected.length) return false;
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

app.post("/webhooks/liquidramp", express.raw({ type: "application/json" }), (req, res) => {
  const rawBody = req.body.toString("utf8");
  const signature = req.headers["liquidramp-signature"];
  const timestamp = req.headers["liquidramp-timestamp"];

  if (!verifyWebhook({ rawBody, signature, timestamp, clientId: PARTNER_REF, encryptionKey: ENC_KEY, path: "/webhooks/liquidramp" })) {
    return res.status(401).send("Invalid signature");
  }

  const payload = JSON.parse(rawBody);
  res.status(200).send("OK");
  processWebhookAsync(payload); // after ack
});