Your own webhook

{
  "check": { "id": "0199…", "name": "Checkout" },
  "detail": "Checkout stopped working. The pay button is gone.",
  "event": "incident.opened",
  "project": {
    "id": "0199…",
    "name": "fitmealplan",
    "url": "https://fitmealplan.app"
  }
}

{
  "confirmUrl": "https://stillworks.watch/r/xY7…",
  "event": "recipient.verification"
}

Add an endpoint to this project that receives signed webhooks from
stillworks.watch and refuses everything else.

Rules, in this order:

1. Read the RAW request body as text before anything parses it. The
   signature covers the exact bytes that were sent, so a framework that
   parses JSON first (express.json, body-parser, a validated body helper)
   silently breaks every signature. Use the raw-body form of whatever
   framework this project already uses.
2. Read the X-Timestamp and X-Signature headers. Answer 400 if the
   timestamp is missing, unparseable, or more than 300 seconds away from
   the current time. That is what stops a captured request being replayed.
3. Build the string `<X-Timestamp>.<raw body>` and compute
   HMAC-SHA256 over it with the secret in STILLWORKS_WEBHOOK_SECRET.
   Hex-encode it, lower case.
4. Compare that to X-Signature in constant time — crypto.timingSafeEqual
   over two buffers of equal length, never === on the strings. Answer 401
   when it differs.
5. Only after all of that, parse the JSON. Its "event" field is one of
   incident.opened, incident.closed, visitor_error.detected or
   recipient.verification.
6. When the event is recipient.verification, log the "confirmUrl" field
   somewhere I will actually see it. A human has to open that link once,
   otherwise stillworks.watch never writes to this endpoint again.
7. Answer 2xx within a second and do any slow work afterwards. The sender
   waits 10 seconds, does not follow redirects, and treats anything that
   is not 2xx as a failed delivery.

Then add STILLWORKS_WEBHOOK_SECRET to the environment example file with a
comment, and tell me the full public https URL of the new endpoint so I can
paste it into stillworks.watch.

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(request: Request): Promise<Response> {
  // The raw text, before any parsing. The signature covers these exact bytes.
  const body = await request.text();
  const timestamp = request.headers.get("x-timestamp") ?? "";
  const signature = request.headers.get("x-signature") ?? "";

  const age = Math.abs(Date.now() / 1000 - Number(timestamp));

  if (!Number.isFinite(age) || age > 300) {
    return new Response(null, { status: 400 });
  }

  const expected = createHmac("sha256", process.env.STILLWORKS_WEBHOOK_SECRET ?? "")
    .update(`${timestamp}.${body}`)
    .digest("hex");
  const mine = Buffer.from(expected, "hex");
  const theirs = Buffer.from(signature, "hex");

  if (mine.length !== theirs.length || !timingSafeEqual(mine, theirs)) {
    return new Response(null, { status: 401 });
  }

  const message = JSON.parse(body);

  if (message.event === "recipient.verification") {
    console.log("Open this once to switch the endpoint on:", message.confirmUrl);
  }

  return new Response(null, { status: 204 });
}

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const app = express();

// express.raw, never express.json: the JSON parser consumes the exact bytes
// the signature was computed over, and nothing you rebuild from the parsed
// object will hash the same way.
app.post("/stillworks", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-Timestamp") ?? "";
  const signature = req.get("X-Signature") ?? "";
  const body = req.body.toString("utf8");
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));

  if (!Number.isFinite(age) || age > 300) return res.sendStatus(400);

  const expected = createHmac("sha256", process.env.STILLWORKS_WEBHOOK_SECRET)
    .update(`${timestamp}.${body}`)
    .digest("hex");
  const mine = Buffer.from(expected, "hex");
  const theirs = Buffer.from(signature, "hex");

  if (mine.length !== theirs.length || !timingSafeEqual(mine, theirs)) {
    return res.sendStatus(401);
  }

  const message = JSON.parse(body);

  if (message.event === "recipient.verification") {
    console.log("Open this once to switch the endpoint on:", message.confirmUrl);
  }

  res.sendStatus(204);
});