Webhooks

A JSON template

{
  "draft_id": "{{visitor.draft_id}}",
  "vehicle": "{{vehicle}}",
  "pickup_location": "{{pickup_location}}",
  "agent": "{{agent_name}}",
  "time": "{{conversation_time}}"
}

What your webhook receives

POST /your-webhook HTTP/1.1
Content-Type: application/json; charset=utf-8
User-Agent: SelviaAI-DataHandoff/1.0
X-Selvia-Timestamp: 1790025248
X-Selvia-Signature: sha256=5f0c…e91a
X-Selvia-Delivery: 4812

{
  "draft_id": "d_8f3a",
  "vehicle": "2019 Honda Civic, grey",
  "pickup_location": "I-35 exit 234, northbound",
  "agent": "Genesis",
  "time": "2026-09-21 21:13 UTC"
}

Node.js (Express)

const crypto = require("crypto");
const express = require("express");
const app = express();

// Keep the raw body: the signature covers the exact bytes that were sent.
app.post("/your-webhook", express.raw({ type: "*/*" }), (req, res) => {
  const ts = req.get("X-Selvia-Timestamp") || "";
  const sig = req.get("X-Selvia-Signature") || "";
  const body = req.body.toString("utf8");

  const expected = "sha256=" + crypto
    .createHmac("sha256", process.env.WEBHOOK_SECRET)   // whsec_… from the console
    .update(ts + "." + body)
    .digest("hex");

  const fresh = /^\d+$/.test(ts) && Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  const valid = sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  if (!fresh || !valid) return res.status(401).end();

  // Skip it if you've already processed req.get("X-Selvia-Delivery"), then:
  res.status(200).end();
});

Python (Flask)

import hashlib, hmac, os, time
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["WEBHOOK_SECRET"].encode()  # whsec_… from the console

@app.post("/your-webhook")
def webhook():
    ts = request.headers.get("X-Selvia-Timestamp", "")
    sig = request.headers.get("X-Selvia-Signature", "")
    body = request.get_data(as_text=True)       # the raw body, before parsing

    expected = "sha256=" + hmac.new(SECRET, f"{ts}.{body}".encode(), hashlib.sha256).hexdigest()
    if not ts.isdigit() or abs(time.time() - int(ts)) > 300 or not hmac.compare_digest(sig, expected):
        abort(401)

    # Skip it if you've already processed request.headers["X-Selvia-Delivery"], then:
    return "", 200

PHP

<?php
$secret = getenv('WEBHOOK_SECRET');               // whsec_… from the console
$ts   = $_SERVER['HTTP_X_SELVIA_TIMESTAMP'] ?? '';
$sig  = $_SERVER['HTTP_X_SELVIA_SIGNATURE'] ?? '';
$body = file_get_contents('php://input');         // the raw body, before parsing

$expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $body, $secret);
if (!ctype_digit($ts) || abs(time() - (int)$ts) > 300 || !hash_equals($expected, $sig)) {
    http_response_code(401);
    exit;
}

// Skip it if you've already processed $_SERVER['HTTP_X_SELVIA_DELIVERY'], then:
http_response_code(200);