Webhooks

{
 "version": 1,
 "event": {
 "key": "task.assigned",
 "occurredAt": 1753963200000,
 "workspaceId": "j57abc..."
 },
 "deliveryId": "kn7xyz...:jd91abc...",
 "data": {
 "workspaceId": "j57abc...",
 "taskId": "jd12...",
 "projectId": "jp34...",
 "assigneeId": "ju56...",
 "title": "Homepage wireframes",
 "assignedAt": 1753963200000,
 "assignerName": "Priya Raman",
 "projectName": "Website Redesign",
 "taskKey": "BLU-142",
 "dueDate": 1754049600000
 }
}

X-TimeTracker-Signature: t=1753963200,v1=5d41402abc4b2a76b9719d911017c592...

${t}.${rawBody}

import crypto from "node:crypto";

function verify(rawBody, header, secret) {
 const parts = Object.fromEntries(
 header.split(",").map((p) => p.split("=", 2)),
 );
 const t = Number(parts.t);
 if (!Number.isFinite(t)) return false;

 // 5-minute replay window
 if (Math.abs(Math.floor(Date.now() / 1000) - t) > 300) return false;

 const expected = crypto
 .createHmac("sha256", secret)
 .update(`${t}.${rawBody}`)
 .digest("hex");

 const a = Buffer.from(expected, "hex");
 const b = Buffer.from(parts.v1 ?? "", "hex");
 return a.length === b.length && crypto.timingSafeEqual(a, b);
}

{
 "version": 1,
 "event": { "key": "webhook.test", "occurredAt": 1753963200000, "workspaceId": "..." },
 "deliveryId": "attempt:...",
 "data": { "test": true }
}