Webhooks

{
  "id": "whmsg_evt_abc123",
  "type": "contact.created",
  "created_at": "2026-07-20T12:00:00.000Z",
  "data": {
    "contact": {
      "id": "ct_abc123",
      "email": "[email protected]",
      "name": "Alex Fan",
      "source": "NEWSLETTER",
      "source_block_id": "blk_abc123",
      "created_at": "2026-07-20T12:00:00.000Z"
    }
  }
}

{
  "id": "whmsg_evt_def456",
  "type": "page.published",
  "created_at": "2026-07-20T12:00:00.000Z",
  "data": {
    "page": {
      "id": "pg_abc123",
      "title": "My links",
      "slug": "maya",
      "published_at": "2026-07-20T12:00:00.000Z"
    }
  }
}

{
  "id": "whmsg_evt_ghi789",
  "type": "sale.paid",
  "created_at": "2026-07-20T12:00:00.000Z",
  "data": {
    "sale": {
      "id": "sl_abc123",
      "kind": "PRODUCT",
      "gross_amount_cents": 1500,
      "net_amount_cents": 1425,
      "currency": "usd",
      "customer_email": "[email protected]",
      "created_at": "2026-07-20T12:00:00.000Z"
    }
  }
}

{
  "id": "whmsg_evt_jkl012",
  "type": "sale.refunded",
  "created_at": "2026-07-20T12:00:00.000Z",
  "data": {
    "sale": {
      "id": "sl_abc123",
      "kind": "PRODUCT",
      "gross_amount_cents": 1500,
      "net_amount_cents": 1425,
      "currency": "usd",
      "customer_email": "[email protected]",
      "created_at": "2026-07-20T12:00:00.000Z"
    }
  }
}

{
  "id": "whmsg_test_9b1c...",
  "type": "endpoint.test",
  "created_at": "2026-07-20T12:00:00.000Z",
  "data": {
    "message": "BioFlow webhook verification — reply 2xx to confirm this endpoint."
  }
}

webhook-id: whmsg_evt_abc123
webhook-timestamp: 1784548800
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pCPT...

// npm install @bioflow/sdk   (source: https://github.com/DevinoSolutions/bioflow-node)
import { isKnownWebhookEvent, verifyWebhook } from "@bioflow/sdk";

// IMPORTANT: pass the RAW request body — verify first, JSON.parse never.
export async function POST(request: Request) {
  const rawBody = await request.text();
  const event = verifyWebhook({
    payload: rawBody,
    headers: request.headers,
    secret: process.env.BIOFLOW_WEBHOOK_SECRET!, // whsec_...
  }); // throws WebhookVerificationError on ANY failure

  // New event types ship without a major SDK bump, so the event union is
  // OPEN. Narrow with the guard to reach the typed payloads; the else branch
  // is a real BioFlow event that is simply newer than your SDK.
  if (!isKnownWebhookEvent(event)) {
    console.log("unhandled event type", event.type);
    return new Response("ok");
  }

  switch (event.type) {
    case "contact.created":
      console.log("new contact", event.data.contact.email);
      break;
    case "sale.paid":
      console.log("sale", event.data.sale.gross_amount_cents);
      break;
  }
  return new Response("ok");
}

import { createHmac, timingSafeEqual } from "node:crypto";

/** Standard Webhooks v1 — verify BEFORE parsing, over the raw bytes. */
function verifyBioFlowWebhook(input) {
  const { id, timestamp, signatureHeader, rawBody, secret } = input;
  // 1. Reject stale timestamps (300s tolerance).
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  // 2. HMAC-SHA256 over "id.timestamp.rawBody", keyed with the
  //    base64-DECODED bytes after the whsec_ prefix.
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = createHmac("sha256", key)
    .update(`${id}.${timestamp}.${rawBody}`, "utf8")
    .digest("base64");
  // 3. The header holds space-separated "v1,<base64>" entries (two during
  //    secret rotation) — constant-time compare against each.
  return signatureHeader.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const a = Buffer.from(signature);
    const b = Buffer.from(expected);
    return a.length === b.length && timingSafeEqual(a, b);
  });
}