Destinations

{
  "id": "dest_abc123def456",
  "workspaceId": "ws_abc123def456",
  "label": "Production Webhook",
  "destinationType": "WEBHOOK",
  "deviceType": "ALL",
  "eventTypes": ["DEVICE_UPDATED", "DEVICE_CONNECTED"],
  "url": "https://example.com/webhook",
  "email": null,
  "phoneNumber": null,
  "secret": "whsec_my-webhook-secret",
  "headers": { "X-Custom-Header": "value" },
  "includeWeather": false,
  "deactivated": false,
  "deactivatedAt": null,
  "deactivatedReason": null,
  "createdAt": "2025-06-01T00:00:00.000Z",
  "updatedAt": "2025-06-01T00:00:00.000Z"
}

{
  "label": "Production Webhook",
  "url": "https://example.com/webhook",
  "eventTypes": ["DEVICE_UPDATED", "DEVICE_CONNECTED"],
  "deviceType": "ALL",
  "secret": "whsec_my-secret-for-hmac-verification",
  "headers": { "X-Custom-Header": "value" }
}

import crypto from "crypto";
 
function verifyWebhookSignature(rawBody, secret, signatureHeader) {
  const computed = crypto
    .createHmac("sha256", secret)
    .update(rawBody) // Use the raw JSON body string — do not re-serialize
    .digest("hex");
 
  // Use timing-safe comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(computed, "hex"),
    Buffer.from(signatureHeader, "hex")
  );
}
 
// In your Express handler:
app.post("/webhooks/texture", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.headers["texture-signature"];
  const timestamp = req.headers["texture-timestamp"];
 
  if (!verifyWebhookSignature(req.body, YOUR_WEBHOOK_SECRET, signature)) {
    return res.status(401).send("Invalid signature");
  }
 
  // Optionally check timestamp to prevent replay attacks
  const ageMs = Date.now() - Number(timestamp);
  if (ageMs > 5 * 60 * 1000) { // 5 minutes
    return res.status(401).send("Webhook too old");
  }
 
  // Process the event
  const event = JSON.parse(req.body);
  console.log("Received event:", event.type);
  res.status(200).send("OK");
});

import hmac
import hashlib
import time
 
def verify_webhook_signature(raw_body: bytes, secret: str, signature_header: str) -> bool:
    computed = hmac.new(
        secret.encode("utf-8"),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(computed, signature_header)
 
# In your Flask handler:
@app.route("/webhooks/texture", methods=["POST"])
def handle_webhook():
    signature = request.headers.get("Texture-Signature")
    timestamp = request.headers.get("Texture-Timestamp")
 
    if not verify_webhook_signature(request.data, YOUR_WEBHOOK_SECRET, signature):
        return "Invalid signature", 401
 
    # Check timestamp freshness (timestamp is Unix milliseconds)
    age_ms = int(time.time() * 1000) - int(timestamp)
    if age_ms > 5 * 60 * 1000:
        return "Webhook too old", 401
 
    event = request.get_json()
    print(f"Received event: {event['type']}")
    return "OK", 200

ngrok http 3000
# Use the ngrok URL as your webhook destination