Webhooks

{
  "eventName": "opportunity.updated",
  "eventDate": "2026-10-05T03:12:45.120Z",
  "workspaceId": "…",
  "webhookId": "…",
  "targetUrl": "https://example.com/hermios",
  "objectMetadata": { "id": "…", "nameSingular": "opportunity" },
  "record": { "id": "…", "name": "Renewal 2027", "stage": "PROPOSAL" },
  "updatedFields": ["stage"],
  "workspaceMemberId": "…"
}

import { createHmac, timingSafeEqual } from 'node:crypto';

export const isValidHermiosWebhook = (
  rawBody: string,
  headers: Record<string, string>,
  secret: string,
) => {
  const timestamp = headers['x-twenty-webhook-timestamp'];
  const signature = headers['x-twenty-webhook-signature'] ?? '';
  const expected = createHmac('sha256', secret)
    .update(`${timestamp}:${rawBody}`)
    .digest('hex');
  const isFresh = Math.abs(Date.now() - Number(timestamp)) < 5 * 60 * 1000;

  return (
    isFresh &&
    signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  );
};