Integrations

import express from "express";
import crypto from "node:crypto";

const SIGNING_SECRET = process.env.REPLAYFY_WEBHOOK_SECRET; // whsec_…
const app = express();

// Use the RAW body — the signature is computed over the exact bytes we send.
app.post(
  "/hooks/replayfy",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const received = req.header("X-Replayfy-Signature") ?? "";
    const expected =
      "sha256=" +
      crypto.createHmac("sha256", SIGNING_SECRET).update(req.body).digest("hex");

    const ok =
      received.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
    if (!ok) return res.status(401).send("bad signature");

    const payload = JSON.parse(req.body.toString("utf8"));
    // e.g. payload.event === "alert.triggered"
    console.log(payload.event, payload.alert?.title);

    // Acknowledge fast with any 2xx.
    res.sendStatus(200);
  },
);

app.listen(3000);

import hashlib, hmac, os
from flask import Flask, request, abort

SIGNING_SECRET = os.environ["REPLAYFY_WEBHOOK_SECRET"].encode()  # whsec_…
app = Flask(__name__)

@app.post("/hooks/replayfy")
def replayfy_hook():
    received = request.headers.get("X-Replayfy-Signature", "")
    expected = "sha256=" + hmac.new(
        SIGNING_SECRET, request.get_data(), hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(received, expected):
        abort(401)

    payload = request.get_json()
    # payload["event"] == "alert.triggered"
    return "", 200