Webhooks

import { Pidgely } from 'pidgely';

const pidgely = new Pidgely(process.env.PIDGELY_API_KEY);

const { data, error } = await pidgely.webhooks.create({
  endpoint: 'https://acme.com/webhooks/pidgely',
  events: ['email.delivered', 'email.bounced', 'email.complained'],
});
console.log(data ?? error);

import os
import pidgely

pidgely.api_key = os.environ["PIDGELY_API_KEY"]

result = pidgely.Webhooks.create({
    "endpoint": "https://acme.com/webhooks/pidgely",
    "events": ["email.delivered", "email.bounced", "email.complained"],
})
print(result)

<?php

require __DIR__ . '/vendor/autoload.php';

$pidgely = Pidgely::client(getenv('PIDGELY_API_KEY'));

$result = $pidgely->webhooks->create([
    'endpoint' => 'https://acme.com/webhooks/pidgely',
    'events' => ['email.delivered', 'email.bounced', 'email.complained'],
]);
var_dump($result);

package main

import (
	"context"
	"fmt"
	"os"

	"github.com/pidgely/pidgely-go"
)

func main() {
	ctx := context.Background()
	client := pidgely.NewClient(os.Getenv("PIDGELY_API_KEY"))

	result, err := client.Webhooks.Create(ctx, &pidgely.CreateWebhookRequest{
		Endpoint: "https://acme.com/webhooks/pidgely",
		Events:   []string{"email.delivered", "email.bounced", "email.complained"},
	})
	if err != nil {
		panic(err)
	}
	fmt.Println(result)
}

require "pidgely"

Pidgely.api_key = ENV["PIDGELY_API_KEY"]

result = Pidgely::Webhooks.create({
  endpoint: "https://acme.com/webhooks/pidgely",
  events: ["email.delivered", "email.bounced", "email.complained"]
})
puts result

curl -X POST 'https://api.pidgely.com/webhooks' \
  -H "Authorization: Bearer $PIDGELY_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
  "endpoint": "https://acme.com/webhooks/pidgely",
  "events": [
    "email.delivered",
    "email.bounced",
    "email.complained"
  ]
}'

import crypto from 'node:crypto';
import express from 'express';

function verify(rawBody, headers, secret) {
  const id = headers['svix-id'] ?? headers['webhook-id'];
  const ts = headers['svix-timestamp'] ?? headers['webhook-timestamp'];
  const sigs = headers['svix-signature'] ?? headers['webhook-signature'];
  if (!id || !ts || !sigs) throw new Error('missing signature headers');
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) throw new Error('timestamp too old');
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = crypto.createHmac('sha256', key).update(`${id}.${ts}.${rawBody}`).digest('base64');
  const ok = sigs.split(' ').some((s) => {
    const sig = s.split(',')[1] ?? '';
    return sig.length === expected.length && crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  });
  if (!ok) throw new Error('invalid signature');
  return JSON.parse(rawBody);
}

const app = express();
app.post('/webhooks/pidgely', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = verify(req.body.toString('utf8'), req.headers, process.env.PIDGELY_WEBHOOK_SECRET);
  } catch {
    return res.sendStatus(400);
  }
  // deduplicate on req.headers['svix-id'], then handle event.type
  res.sendStatus(200);
});

import base64, hashlib, hmac, json, time

def verify(body: bytes, headers, secret: str):
    msg_id = headers.get("svix-id") or headers.get("webhook-id")
    ts = headers.get("svix-timestamp") or headers.get("webhook-timestamp")
    sigs = headers.get("svix-signature") or headers.get("webhook-signature")
    if not (msg_id and ts and sigs):
        raise ValueError("missing signature headers")
    if abs(time.time() - int(ts)) > 300:
        raise ValueError("timestamp too old")
    key = base64.b64decode(secret.removeprefix("whsec_"))
    mac = hmac.new(key, f"{msg_id}.{ts}.".encode() + body, hashlib.sha256).digest()
    expected = base64.b64encode(mac).decode()
    if not any(hmac.compare_digest(s.split(",", 1)[-1], expected) for s in sigs.split(" ")):
        raise ValueError("invalid signature")
    return json.loads(body)

# Flask: event = verify(request.get_data(), request.headers, os.environ["PIDGELY_WEBHOOK_SECRET"])

<?php

function verify_webhook(string $body, array $h, string $secret): array {
    $id = $h['svix-id'] ?? $h['webhook-id'] ?? null;
    $ts = $h['svix-timestamp'] ?? $h['webhook-timestamp'] ?? null;
    $sigs = $h['svix-signature'] ?? $h['webhook-signature'] ?? null;
    if (!$id || !$ts || !$sigs) throw new Exception('missing signature headers');
    if (abs(time() - (int) $ts) > 300) throw new Exception('timestamp too old');
    $key = base64_decode(preg_replace('/^whsec_/', '', $secret));
    $expected = base64_encode(hash_hmac('sha256', "$id.$ts.$body", $key, true));
    foreach (explode(' ', $sigs) as $s) {
        $parts = explode(',', $s, 2);
        if (isset($parts[1]) && hash_equals($expected, $parts[1])) return json_decode($body, true);
    }
    throw new Exception('invalid signature');
}

$headers = array_change_key_case(getallheaders(), CASE_LOWER);
$event = verify_webhook(file_get_contents('php://input'), $headers, getenv('PIDGELY_WEBHOOK_SECRET'));

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"math"
	"net/http"
	"strconv"
	"strings"
	"time"
)

func header(h http.Header, a, b string) string {
	if v := h.Get(a); v != "" {
		return v
	}
	return h.Get(b)
}

// Verify checks a Pidgely webhook. body must be the raw request body.
func Verify(body []byte, h http.Header, secret string) error {
	id, ts, sigs := header(h, "svix-id", "webhook-id"), header(h, "svix-timestamp", "webhook-timestamp"), header(h, "svix-signature", "webhook-signature")
	if id == "" || ts == "" || sigs == "" {
		return errors.New("missing signature headers")
	}
	sec, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || math.Abs(float64(time.Now().Unix()-sec)) > 300 {
		return errors.New("timestamp too old")
	}
	key, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, "whsec_"))
	if err != nil {
		return err
	}
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(id + "." + ts + "."))
	mac.Write(body)
	expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))
	for _, s := range strings.Split(sigs, " ") {
		if _, sig, ok := strings.Cut(s, ","); ok && hmac.Equal([]byte(sig), []byte(expected)) {
			return nil
		}
	}
	return errors.New("invalid signature")
}

require "base64"
require "json"
require "openssl"

def verify_webhook(body, headers, secret)
  id = headers["svix-id"] || headers["webhook-id"]
  ts = headers["svix-timestamp"] || headers["webhook-timestamp"]
  sigs = headers["svix-signature"] || headers["webhook-signature"]
  raise "missing signature headers" unless id && ts && sigs
  raise "timestamp too old" if (Time.now.to_i - ts.to_i).abs > 300

  key = Base64.strict_decode64(secret.delete_prefix("whsec_"))
  expected = Base64.strict_encode64(OpenSSL::HMAC.digest("SHA256", key, "#{id}.#{ts}.#{body}"))
  ok = sigs.split(" ").any? { |s| OpenSSL.secure_compare(s.split(",", 2).last.to_s, expected) }
  raise "invalid signature" unless ok

  JSON.parse(body)
end

# Rails: verify_webhook(request.raw_post, request.headers, ENV.fetch("PIDGELY_WEBHOOK_SECRET"))