Webhook

import express from 'express';
import { WhatsAppIncomingData } from 'a1base-node';

const app = express();
app.use(express.json());

app.post('/whatsapp/incoming', async (req, res) => {
  const {
    thread_id,
    message_id,
    thread_type,
    sender_number,
    sender_name,
    a1_account_id,
    a1_phone_number,
    timestamp,
    service,
    message_type,
    is_from_agent,
    message_content,
  } = req.body as WhatsAppIncomingData;
  // Process the incoming message
  console.log(`Received message from ${sender_name}: ${message_content.text}`);
  
  // Always respond with 200 to acknowledge receipt
  res.json({ success: true });
});

startLine: 130
endLine: 209

import crypto from 'crypto';
import express from 'express';
const app = express();

app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf; // capture raw body for HMAC check
  }
}));

app.post('/whatsapp/incoming', (req, res) => {
  const rawBody = req.rawBody.toString();
  const timestamp = req.headers['x-timestamp'];
  const receivedSig = req.headers['x-signature'];
  const secret = process.env.A1BASE_API_SECRET;

  const expectedSig = crypto
    .createHmac('sha256', secret)
    .update(timestamp + rawBody)
    .digest('hex');

  if (receivedSig !== expectedSig) {
    return res.status(403).send('Invalid signature');
  }

  // Continue processing the verified request
  res.sendStatus(200);
});