Webhooks

{
  "id": "evt_3kd9",
  "type": "question.completed",
  "createdAt": "2026-10-10T10:12:00Z",
  "apiVersion": "2026-10-10",
  "data": {
    "questionId": "q_8k2f",
    "status": "complete",
    "summary": {
      "winner": "Menu B",
      "margin": 36,
      "confidence": "high",
      "note": "Menu B led by 36 points.",
      "suggestedFollowUp": null
    },
    "creditsSpent": 600,
    "refundCredits": 0,
    "teamId": "team_4hq1",
    "projectId": "prj_launch",
    "labels": [
      "pricing"
    ]
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// Standard Webhooks: webhook-signature is "v1,<base64>" entries, space-separated,
// each a base64 HMAC-SHA256 of "<webhook-id>.<webhook-timestamp>.<raw body>".
// The key is the base64 after "whsec_", decoded.
export function verifyWebhook(rawBody: string, headers: Headers, secret: string, toleranceSec = 300): boolean {
  const id = headers.get("webhook-id");
  const timestamp = headers.get("webhook-timestamp");
  const signatures = headers.get("webhook-signature");
  if (!id || !timestamp || !signatures) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSec) return false;
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = createHmac("sha256", key).update(`${id}.${timestamp}.${rawBody}`).digest();
  return signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const given = Buffer.from(signature, "base64");
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

import base64, hashlib, hmac, time

def verify_webhook(raw_body: bytes, headers, secret: str, tolerance: int = 300) -> bool:
    msg_id = headers.get("webhook-id")
    timestamp = headers.get("webhook-timestamp") or ""
    signatures = headers.get("webhook-signature")
    if not (msg_id and timestamp.isdigit() and signatures):
        return False
    if abs(time.time() - int(timestamp)) > tolerance:
        return False
    # Accepts standard and URL-safe base64, so secrets made before October 2026 work too.
    b64 = secret.removeprefix("whsec_").replace("-", "+").replace("_", "/")
    key = base64.b64decode(b64 + "=" * (-len(b64) % 4))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()
    return any(
        version == "v1" and hmac.compare_digest(signature, expected)
        for version, _, signature in (entry.partition(",") for entry in signatures.split(" "))
    )

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"net/http"
	"strconv"
	"strings"
	"time"
)

// Verify checks the Standard Webhooks headers against the raw body.
func Verify(body []byte, h http.Header, secret string) bool {
	id, ts, sigs := h.Get("webhook-id"), h.Get("webhook-timestamp"), h.Get("webhook-signature")
	t, err := strconv.ParseInt(ts, 10, 64)
	if id == "" || sigs == "" || err != nil {
		return false
	}
	if d := time.Now().Unix() - t; d > 300 || d < -300 {
		return false
	}
	// Accepts standard and URL-safe base64, so secrets made before October 2026 work too.
	b64 := strings.NewReplacer("-", "+", "_", "/").Replace(strings.TrimPrefix(secret, "whsec_"))
	key, err := base64.RawStdEncoding.DecodeString(strings.TrimRight(b64, "="))
	if err != nil {
		return false
	}
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(id + "." + ts + "."))
	mac.Write(body)
	expected := mac.Sum(nil)
	for _, entry := range strings.Split(sigs, " ") {
		version, sig, ok := strings.Cut(entry, ",")
		if !ok || version != "v1" {
			continue
		}
		if given, err := base64.StdEncoding.DecodeString(sig); err == nil && hmac.Equal(given, expected) {
			return true
		}
	}
	return false
}

import { createHmac, timingSafeEqual } from "node:crypto";

// x-50heads-signature: t=<unix seconds>,v1=<hex>[,v1=<hex>]
// Each v1 is a hex HMAC-SHA256 of "<t>.<raw body>", keyed with the whole secret string.
export function verifyLegacy(rawBody: string, header: string, secret: string, toleranceSec = 300): boolean {
  const parts = header.split(",").map((p) => p.trim().split("=") as [string, string | undefined]);
  const t = Number(parts.find(([k]) => k === "t")?.[1]);
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  return parts
    .filter(([k]) => k === "v1")
    .some(([, v]) => {
      const given = Buffer.from(v ?? "", "hex");
      return given.length === expected.length && timingSafeEqual(given, expected);
    });
}

import hashlib, hmac, time

# x-50heads-signature: t=<unix seconds>,v1=<hex>[,v1=<hex>]
def verify_legacy(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    pairs = [p.strip().partition("=") for p in header.split(",")]
    t = next((v for k, _, v in pairs if k == "t"), "")
    if not t.isdigit() or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return any(k == "v1" and hmac.compare_digest(v, expected) for k, _, v in pairs)

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"strings"
	"time"
)

// VerifyLegacy checks x-50heads-signature: t=<unix seconds>,v1=<hex>[,v1=<hex>].
func VerifyLegacy(body []byte, header, secret string) bool {
	var t string
	var sigs []string
	for _, part := range strings.Split(header, ",") {
		k, v, _ := strings.Cut(strings.TrimSpace(part), "=")
		switch k {
		case "t":
			t = v
		case "v1":
			sigs = append(sigs, v)
		}
	}
	ts, err := strconv.ParseInt(t, 10, 64)
	if err != nil {
		return false
	}
	if d := time.Now().Unix() - ts; d > 300 || d < -300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(t + "."))
	mac.Write(body)
	expected := mac.Sum(nil)
	for _, s := range sigs {
		if given, err := hex.DecodeString(s); err == nil && hmac.Equal(given, expected) {
			return true
		}
	}
	return false
}

curl -X POST https://api.50heads.com/v1/webhooks/endpoints/whe_123/rotate-secret \
  -H "Authorization: Bearer $FIFTYHEADS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"overlapHours": 48}'

{
  "filter": {
    "projectIds": [
      "prj_launch"
    ],
    "labels": [
      "pricing",
      "naming"
    ]
  }
}

curl -X POST https://api.50heads.com/v1/webhooks/endpoints \
  -H "Authorization: Bearer $FIFTYHEADS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/hooks/50heads", "events": ["question.completed"]}'