Webhooks: Receive and Verify Async Brand Generation Results

import express from "express";
import crypto from "crypto";

const app = express();
const webhookSecret = process.env.NOMIQ_WEBHOOK_SECRET; // "whsec_abc123"

// IMPORTANT: Use express.raw() so the body is not parsed.
// JSON body-parser middleware will break signature verification.
app.post(
  "/api/nomiq/webhook",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const receivedSig = req.headers["nomiq-signature"];
    const rawBody = req.body; // Buffer

    const expectedSig = crypto
      .createHmac("sha256", webhookSecret)
      .update(rawBody)
      .digest("hex");

    if (
      !crypto.timingSafeEqual(
        Buffer.from(receivedSig, "hex"),
        Buffer.from(expectedSig, "hex")
      )
    ) {
      console.error("Webhook signature mismatch — request rejected.");
      return res.status(400).send("Invalid signature");
    }

    // Signature verified — safe to process the payload
    const event = JSON.parse(rawBody.toString("utf8"));
    console.log("Verified event type:", event.type);

    // Queue heavy processing asynchronously; return 200 immediately
    res.status(200).send();
  }
);

import hashlib
import hmac
import json
import os
from flask import Flask, request, jsonify

app = Flask(__name__)
webhook_secret = os.environ.get("NOMIQ_WEBHOOK_SECRET")  # "whsec_abc123"


@app.route("/api/nomiq/webhook", methods=["POST"])
def nomiq_webhook():
    received_sig = request.headers.get("Nomiq-Signature", "")
    raw_body = request.get_data()  # raw bytes — do NOT use request.json here

    expected_sig = hmac.new(
        webhook_secret.encode("utf-8"),
        raw_body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected_sig, received_sig):
        return jsonify(error="Invalid signature"), 400

    # Signature verified — safe to process the payload
    event = json.loads(raw_body)
    print("Verified event type:", event["type"])

    # Queue heavy processing asynchronously; return 200 immediately
    return jsonify(success=True), 200