Webhooks

{
  "id": "kfwh_1778175301000_k9x2abp1",
  "event": "message.sent",
  "createdAt": "2026-05-07T12:00:00.000Z",
  "data": {
    "reference": "omni_1778175300000_a1b2c3",
    "to": "255700000000",
    "messageType": "text",
    "status": "sent",
    "winningChannel": "whatsapp_qr",
    "deliveryMode": "fallback",
    "requestedChannels": ["whatsapp_qr", "whatsapp_meta", "sms"],
    "attempts": [
      { "channel": "whatsapp_qr", "success": true, "messageId": "3EB0..." }
    ]
  }
}

timestamp.raw_json_body

sha256=<hex_digest>

import crypto from "crypto";
import express from "express";

const app = express();

app.post(
  "/karflows/webhook",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const secret = process.env.KARFLOWS_WEBHOOK_SECRET;
    const timestamp = req.get("X-KarFlows-Timestamp");
    const received = req.get("X-KarFlows-Signature") || "";
    const body = req.body.toString("utf8");

    const expected =
      "sha256=" +
      crypto
        .createHmac("sha256", secret)
        .update(`${timestamp}.${body}`)
        .digest("hex");

    const valid =
      received.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));

    if (!valid) {
      return res.status(401).send("invalid signature");
    }

    const event = JSON.parse(body);
    console.log("KarFlows event", event.event, event.data);

    return res.sendStatus(200);
  }
);

return res.sendStatus(200);