الويبهوك

{
  "id": "dlv_20",
  "event": "ticket.created",
  "createdAt": "2026-07-31T09:01:00.000Z",
  "data": {
    "id": "tkt_5",
    "number": 1043,
    "subject": "Cannot log in",
    "status": "OPEN"
  }
}

X-AwnCare-Event: ticket.created
X-AwnCare-Signature: t=1753952460,v1=4f8c1e…hex-hmac…

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.AWNCARE_WEBHOOK_SECRET; // whsec_…

// IMPORTANT: verify against the RAW body, before JSON parsing.
app.post(
  "/hooks/awncare",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const header = req.get("X-AwnCare-Signature") || "";
    const rawBody = req.body.toString("utf8");

    // Header format: "t=<unix>,v1=<hex hmac-sha256('<t>.<rawBody>')>"
    const parts = Object.fromEntries(
      header.split(",").map((kv) => kv.split("="))
    );
    const timestamp = parts.t;
    const signature = parts.v1;

    const expected = crypto
      .createHmac("sha256", SECRET)
      .update(`${timestamp}.${rawBody}`)
      .digest("hex");

    const valid =
      signature &&
      crypto.timingSafeEqual(
        Buffer.from(signature),
        Buffer.from(expected)
      );

    if (!valid) return res.status(400).send("invalid signature");

    // Optional: reject old timestamps to prevent replay.
    const ageSec = Math.abs(Date.now() / 1000 - Number(timestamp));
    if (ageSec > 300) return res.status(400).send("stale timestamp");

    const event = JSON.parse(rawBody);
    console.log("Verified", event.event, event.id);

    res.sendStatus(200); // ack fast — process async
  }
);

app.listen(3000);

<?php
// AwnCare webhook receiver — signature verification.
$secret = getenv('AWNCARE_WEBHOOK_SECRET'); // whsec_…
$rawBody = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_AWNCARE_SIGNATURE'] ?? '';

// Parse "t=<unix>,v1=<hex>"
parse_str(str_replace(',', '&', $header), $parts);
$timestamp = $parts['t'] ?? '';
$signature = $parts['v1'] ?? '';

$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(400);
    exit('invalid signature');
}

// Optional replay guard.
if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit('stale timestamp');
}

$event = json_decode($rawBody, true);
error_log('Verified ' . $event['event'] . ' ' . $event['id']);

http_response_code(200); // ack fast