Webhooks Overview

function verifyWebhookAuth(authHeader, expectedSecret) {
  const token = authHeader.replace('Bearer ', '');
  return token === expectedSecret;
}

// Usage in your webhook endpoint
app.post('/en/developers/webhooks/tiro', (req, res) => {
  const authHeader = req.headers.authorization;
  
  if (!verifyWebhookAuth(authHeader, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Unauthorized');
  }
  
  // Process webhook event
  const event = req.body;
  handleWebhookEvent(event);
  
  res.status(200).send('OK');
});

import os
from flask import Flask, request

def verify_webhook_auth(auth_header, expected_secret):
    if not auth_header or not auth_header.startswith('Bearer '):
        return False
    token = auth_header.replace('Bearer ', '')
    return token == expected_secret

# Usage in your webhook endpoint
@app.route('/en/developers/webhooks/tiro', methods=['POST'])
def handle_webhook():
    auth_header = request.headers.get('Authorization')
    
    if not verify_webhook_auth(auth_header, os.getenv('WEBHOOK_SECRET')):
        return 'Unauthorized', 401
    
    # Process webhook event
    event = request.get_json()
    handle_webhook_event(event)
    
    return 'OK', 200

import (
    "encoding/json"
    "net/http"
    "os"
    "strings"
)

func verifyWebhookAuth(authHeader, expectedSecret string) bool {
    if !strings.HasPrefix(authHeader, "Bearer ") {
        return false
    }
    token := strings.TrimPrefix(authHeader, "Bearer ")
    return token == expectedSecret
}

// Usage in your webhook endpoint
func handleWebhook(w http.ResponseWriter, r *http.Request) {
    authHeader := r.Header.Get("Authorization")
    
    if !verifyWebhookAuth(authHeader, os.Getenv("WEBHOOK_SECRET")) {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    
    // Process webhook event
    var event WebhookEvent
    json.NewDecoder(r.Body).Decode(&event)
    handleWebhookEvent(event)
    
    w.WriteHeader(http.StatusOK)
}

@RestController
class WebhookController {
    
    @Value("\${webhook.secret}")
    private lateinit var webhookSecret: String
    
    private fun verifyWebhookAuth(authHeader: String?, expectedSecret: String): Boolean {
        if (authHeader?.startsWith("Bearer ") != true) {
            return false
        }
        val token = authHeader.removePrefix("Bearer ")
        return token == expectedSecret
    }
    
    // Usage in your webhook endpoint
    @PostMapping("/en/developers/webhooks/tiro")
    fun handleWebhook(
        @RequestHeader("Authorization") authHeader: String?,
        @RequestBody event: WebhookEvent
    ): ResponseEntity<String> {
        if (!verifyWebhookAuth(authHeader, webhookSecret)) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized")
        }
        
        // Process webhook event
        handleWebhookEvent(event)
        return ResponseEntity.ok("OK")
    }
}