เว็บฮุก เหตุการณ์แบบเรียลไทม์

import crypto from 'crypto';

const app = express();

const WEBHOOK_SECRET = process.env.PAPEROFFICE_WEBHOOK_SECRET;

app.post('/webhooks/paperoffice', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.header('X-PaperOffice-Signature'); // "sha256=..."
  const eventId   = req.header('X-PaperOffice-Event-ID');
  const eventType = req.header('X-PaperOffice-Event');

  const expected = 'sha256=' + crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('invalid signature');
  }

  const event = JSON.parse(req.body.toString());
  // eventId als Idempotency-Key speichern -> gleiche ID nicht zweimal verarbeiten
  console.log(eventType, event.data);
  res.status(200).send('ok');
});

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = os.environ["PAPEROFFICE_WEBHOOK_SECRET"]

@app.route("/webhooks/paperoffice", methods=["POST"])
def paperoffice_webhook():
    signature = request.headers.get("X-PaperOffice-Signature", "")
    event_id   = request.headers.get("X-PaperOffice-Event-ID", "")
    event_type = request.headers.get("X-PaperOffice-Event", "")

    expected = "sha256=" + hmac.new(
        WEBHOOK_SECRET.encode(),
        request.get_data(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)

    payload = request.get_json()
    # event_id als Idempotency-Key in DB speichern
    print(event_type, payload["data"])
    return "ok", 200

<?php
// PaperOffice Webhook-Receiver mit HMAC-SHA256 Signatur-Verifizierung
$secret = getenv('PAPEROFFICE_WEBHOOK_SECRET');
$raw    = file_get_contents('php://input');

$signature  = $_SERVER['HTTP_X_PAPEROFFICE_SIGNATURE'] ?? '';
$event_id   = $_SERVER['HTTP_X_PAPEROFFICE_EVENT_ID'] ?? '';
$event_type = $_SERVER['HTTP_X_PAPEROFFICE_EVENT'] ?? '';

$expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('invalid signature');
}

$event = json_decode($raw, true);
// event_id als Idempotency-Key in DB speichern
error_log("{$event_type}: " . json_encode($event['data']));
http_response_code(200);
echo 'ok';

curl -X POST https://api.paperoffice.ai/latest/webhooks/subscribe \
  -H "Authorization: Bearer po_ut_xxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Production Webhook",
    "url": "https://yourdomain.com/webhooks/paperoffice",
    "events": ["document.processed", "job.completed", "job.failed"],
    "retry_policy": "exponential",
    "max_retries": 5,
    "timeout_ms": 10000
  }'