Contact method webhooks

POST /your/endpoint HTTP/1.1
Content-Type: application/json
User-Agent: Custral-Webhooks/1.0
X-Custral-Event: contact.message
X-Custral-Signature: t=1792090000,v1=5f2b…

{
  "type": "contact.message",
  "workspace": "Pied Piper",
  "from": {"name": "Richard Hendricks", "email": "richard@piedpiper.com"},
  "to": {"name": "Jin Yang", "email": "jin@piedpiper.com"},
  "message": "Can you look at the Hooli deck before 3?",
  "sentAt": "2026-10-15T20:12:44.512Z"
}

import crypto from "node:crypto";

function verify(rawBody: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(header.split(",").map((part) => part.split("=")));
  const expected = crypto.createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const given = Buffer.from(parts.v1 ?? "", "hex");
  const wanted = Buffer.from(expected, "hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && given.length === wanted.length && crypto.timingSafeEqual(given, wanted);
}