Webhook Endpoints

Verifying Webhook Signatures

Webhooks include a signature in the X-BookingSaaS-Signature header. Verify this signature to ensure the webhook is authentic.

// Example: Verifying webhook signature in Node.js
const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const [tPart, vPart] = signature.split(',');
  const timestamp = tPart.split('=')[1];
  const expectedSig = vPart.split('=')[1];
  
  const signedPayload = `${timestamp}.${payload}`;
  const computedSig = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
    
  return computedSig === expectedSig;
}