Webhooks

const crypto = require('node:crypto')

function verify(secret, id, timestamp, rawBody, signatureHeader) {
  const age = Math.abs(Date.now() / 1000 - Number(timestamp))
  if (!Number.isFinite(age) || age > 300) return false // more than five minutes from our clock
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
  const expected = crypto.createHmac('sha256', key)
    .update(`${id}.${timestamp}.${rawBody}`).digest('base64')
  const a = Buffer.from(`v1,${expected}`)
  return signatureHeader.split(' ').some(candidate => {
    const b = Buffer.from(candidate)
    return a.length === b.length && crypto.timingSafeEqual(a, b)
  })
}

{
  "type": "grant.revoked",
  "id": "evt_3b1f6c0e9a2d4f7b8c5e1a2b3c4d5e6f",
  "created_at": "2026-11-05T09:30:00Z",
  "data": {
    "grant_id": "6f1c2a9e-3b7d-4c51-9e2a-0d4b8f6a1c33",
    "pilot_id": "2d9b7c1e-8f4a-4e3b-a6d5-91c0f2e7b844",
    "reason": "pilot"
  }
}