Securing your webhook

import Doczilla from '@doczilla/node'
import express from 'express'

const doczilla = new Doczilla('doczilla-...')

// Set your webhook secret here
const webhookSecret = 'whsec-...'

const app = express()

// Match the raw body to content type application/json
app.post(
  '/webhook',
  express.raw({ type: 'application/json' }),
  (request, response) => {
    const signature = request.headers['x-doczilla-signature']

    try {
      const payload = doczilla.webhook.verifyPayload(request.body, signature, webhookSecret)

      // Do something with the generated document
      console.log(payload)

      // Return a response to acknowledge receipt of the event
      response.json({ received: true })

    } catch (err) {
      response.status(400).send('Signature invalid!')
    }
  }
)

app.listen(4242, () => console.log('Running on port 4242'))

import crypto from 'node:crypto'

const payloadSignature = crypto
  .createHmac('sha256', webhookSecret)
  .update(rawBody, 'utf8')
  .digest('hex')

if (payloadSignature === signature) {
  // Valid
}