Webhooks

POST /your/endpoint HTTP/1.1
Content-Type: application/json
X-Overlay-Event: automation.finished
X-Overlay-Event-Id: automation.finished:k57d…
X-Overlay-Delivery-Id: …
X-Overlay-Timestamp: 1792700000000
X-Overlay-Signature: sha256=4f1c…

{
  "id": "automation.finished:k57d…",
  "type": "automation.finished",
  "createdAt": 1792700000000,
  "userId": "user_…",
  "data": {
    "automationId": "j97a…",
    "runId": "k57d…",
    "conversationId": "m12f…"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyOverlayWebhook(rawBody: string, headers: Headers, secret: string) {
  const timestamp = headers.get("x-overlay-timestamp") ?? "";
  const received = headers.get("x-overlay-signature") ?? "";
  const expected =
    "sha256=" + createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");

  const fresh = Math.abs(Date.now() - Number(timestamp)) < 5 * 60 * 1000;
  return (
    fresh &&
    received.length === expected.length &&
    timingSafeEqual(Buffer.from(received), Buffer.from(expected))
  );
}