Check a webhook signature

Make sure a webhook really came from Nuha Chat before you trust it.

4 minPlans: Pro and Max

Before you start

1
Read the headers
Each POST has x-nuha-signature: t=…,v1=…, plus x-nuha-event (the event name) and x-nuha-delivery (the delivery id).
2
Rebuild the signature
Take t, add a dot, then the raw request body exactly as received: t + "." + body. Make an HMAC-SHA256 of that with your signing secret, as hex.
3
Compare
In Node: const sig = crypto.createHmac('sha256', secret).update(t + '.' + rawBody).digest('hex'). It must equal v1. Use a timing-safe compare.
4
Check it is fresh
t is the time in Unix seconds. Reject messages older than about 5 minutes, so an old message cannot be replayed.
5
Reply quickly
Return any 2xx status within 8 seconds. Do slow work after you reply. Use the delivery id to skip events you already handled.

Use the raw body. If your framework parses the JSON first and you turn it back into text, the signature may not match.

The signature never matches

Check you use the raw body, the whole secret including whsec_, and the t value from the same header.

I get the same event twice

A retry can arrive if your server was slow. Skip events whose id you already handled.