Webhooks and custom API

{
  "id": "evt_4f1c0a9d2b7e4c53a1d86e0f9b3c7a21",
  "type": "payment_link.paid",
  "created_at": "2026-10-07T09:30:00.000Z",
  "workspace_id": "your-workspace-id",
  "data": {
    "payment_link_id": "…",
    "amount_minor": 4000,
    "currency": "GBP",
    "description": "Deposit",
    "conversation_id": "…",
    "customer": { "name": "Emma Larsson", "phone": "+447700900412" }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

function isFromCompanion(secret, rawBody, header) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const timestamp = Number(parts.t);
  if (!Number.isFinite(timestamp) || !parts.v1) return false;

  // Refuse old requests, so a captured one cannot be replayed later.
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) return false;

  const expected = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}