Signed webhooks for every widget event

{
  "id": "1842",
  "event_type": "submission",
  "widget_id": "0b8b6f8e-6f4f-4a52-9a5c-8f0f2b2f1c11",
  "timestamp": "2026-11-02 10:00:00.000",
  "data": {
    "name": "Ada Lovelace",
    "email": "[email protected]",
    "message": "Can we book a demo next week?"
  },
  "context": {
    "page": "https://example.com/contact",
    "country": "GB",
    "device": "desktop"
  }
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.WIDGETJAR_WEBHOOK_SECRET;

// Keep the raw body: the signature covers the exact bytes we sent.
app.post('/hooks/widgetjar', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-WidgetJar-Timestamp');
  const signature = req.get('X-WidgetJar-Signature') ?? '';
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', SECRET).update(`${timestamp}.${req.body}`).digest('hex');

  const valid =
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;
  if (!valid || !fresh) return res.sendStatus(401);

  const event = JSON.parse(req.body);
  // Use event.id to ignore a delivery you have already processed.
  console.log(event.event_type, event.data);
  res.sendStatus(200);
});

import hashlib, hmac, os, time
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["WIDGETJAR_WEBHOOK_SECRET"].encode()

@app.post("/hooks/widgetjar")
def widgetjar_hook():
    timestamp = request.headers.get("X-WidgetJar-Timestamp", "")
    signature = request.headers.get("X-WidgetJar-Signature", "")
    body = request.get_data()  # raw bytes
    expected = "sha256=" + hmac.new(
        SECRET, timestamp.encode() + b"." + body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)
    if abs(time.time() - int(timestamp or 0)) > 300:
        abort(401)

    event = request.get_json()
    print(event["event_type"], event["data"])
    return "", 200