Webhooks

{
  "id": "evt_abc123def456",
  "object": "event",
  "type": "recognition.created",
  "created_at": "2026-02-06T14:00:00Z",
  "api_version": "2026-01-01",
  "data": {
    "object": {
      "id": "550e8400-e29b-41d4-a716-446655440003",
      "sender": { "id": "...", "name": "Jane Doe" },
      "recipient": { "id": "...", "name": "John Smith" },
      "message": "Great work on the launch!",
      "points": 50
    }
  },
  "metadata": {
    "organization_id": "org_xyz789",
    "triggered_by": "user_abc123"
  }
}

import crypto from 'crypto';

function verifyWebhookSignature(payload: string, signature: string, secret: string): boolean {
  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

// In your webhook handler:
app.post('/webhooks/brighten', (req, res) => {
  const signature = req.headers['x-brighten-signature'];
  const isValid = verifyWebhookSignature(req.rawBody, signature, process.env.BRIGHTEN_WEBHOOK_SECRET);

  if (!isValid) return res.status(401).json({ error: 'Invalid signature' });

  const event = JSON.parse(req.rawBody);
  console.log('Received event:', event.type);
  res.status(200).json({ received: true });
});

import hmac, hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_secret_here"

def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

@app.route('/webhooks/brighten', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Brighten-Signature', '')
    if not verify_signature(request.data, signature, WEBHOOK_SECRET):
        return jsonify({"error": "Invalid signature"}), 401
    event = request.get_json()
    print(f"Received event: {event['type']}")
    return jsonify({"received": True}), 200