Webhooks

{
  "event_id": "9a7b6c5d-4e3f-4a1b-8c2d-0e1f2a3b4c5d",
  "event_type": "lead.replied",
  "schema_version": "2026-10-08",
  "occurred_at": "2026-10-21T09:30:00.000Z",
  "workspace_id": "8d0b6a52-6f0e-4d63-9a51-2b7c3f1e9a10",
  "lead_id": "0b8e2c6d-4f1a-4b7e-9d3c-6a5f4e3d2c1b",
  "external_id": "crm-1042",
  "ig_username": "jane.doe",
  "lead_name": "Jane Doe",
  "lead_status": "replied",
  "lead_tags": "webinar,coach",
  "campaign_id": "2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f",
  "campaign_name": "October webinar",
  "rep_ig_username": "acme.anna",
  "conversation_id": "7f6e5d4c-3b2a-4190-8f7e-6d5c4b3a2918",
  "conversation_url": "https://app.dmhero.ai/inbox?c=7f6e5d4c-3b2a-4190-8f7e-6d5c4b3a2918",
  "campaign_step": 1,
  "handed_to_setter": true,
  "cf_offer": "Mentoring"
}

x-dmhero-signature: t=1761039000,v1=5f8a...e21c

import crypto from "node:crypto";

// rawBody: the request body exactly as received, before any JSON parsing.
export function verifyDmHeroSignature(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  if (!signatureHeader) return false;
  let timestamp = null;
  const signatures = [];
  for (const part of signatureHeader.split(",")) {
    const [key, value] = part.trim().split("=");
    if (key === "t") timestamp = value;
    else if (key === "v1" && value) signatures.push(value);
  }
  if (!timestamp || !/^\d+$/.test(timestamp) || signatures.length === 0) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest();
  return signatures.some((sig) => {
    const given = Buffer.from(sig, "hex");
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

import express from "express";

const app = express();

// express.raw keeps the exact bytes: a re-serialized JSON body would not match the signature.
app.post("/dmhero/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyDmHeroSignature(req.body, req.get("x-dmhero-signature"), process.env.DMHERO_WEBHOOK_SECRET)) {
    return res.status(401).end();
  }
  const event = JSON.parse(req.body);
  // A delivery can arrive more than once: deduplicate on event.event_id.
  // Answer fast (within 10 seconds) and do slow work in the background.
  res.status(200).end();
});

import hashlib
import hmac
import time


def verify_dmhero_signature(raw_body: bytes, signature_header: str, secret: str, tolerance_seconds: int = 300) -> bool:
    """raw_body: the request body exactly as received, before any JSON parsing."""
    if not signature_header:
        return False
    timestamp = None
    signatures = []
    for part in signature_header.split(","):
        key, _, value = part.strip().partition("=")
        if key == "t":
            timestamp = value
        elif key == "v1" and value:
            signatures.append(value)
    if not timestamp or not timestamp.isdigit() or not signatures:
        return False
    if abs(time.time() - int(timestamp)) > tolerance_seconds:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, sig.lower()) for sig in signatures if sig.isascii())

from flask import Flask, request, abort
import os

app = Flask(__name__)


@app.post("/dmhero/webhooks")
def dmhero_webhook():
    if not verify_dmhero_signature(request.get_data(), request.headers.get("x-dmhero-signature", ""), os.environ["DMHERO_WEBHOOK_SECRET"]):
        abort(401)
    event = request.get_json()
    # Deduplicate on event["event_id"], answer fast, work in the background.
    return "", 200