Validating Webhooks

When a webhook is received, it's important to validate that the request is coming from VenueRun and not from a malicious third party. This is done by validating the request using the HMAC signature that is included in the headers of the webhook request.

index.js

// Initialize the VenueRun SDK
const VenueRun = new VenueRunSDK({
  apiKey: process.env.VENUERUN_API_KEY,
  merchantId: process.env.VENUERUN_MERCHANT_ID,
});

app.post("/", async (req, res) => {
  try {
    const bearer = req.headers.authorization.split(" ")[1];

    const wekbookId = "CN9UTwhV6BbRdPqLZMlV";

    try {
      const isValid = VenueRun.verifyWebhookSignature(
        wekbookId,
        bearer,
        req.body
      );
    } catch (error) {
      console.error("Error", error);
      return res.status(401).json({ error: error.message });
    }

    const { event, data } = req.body;

    const eventDetails = webhookEvents.find((e) => e.value === event);

    switch (event) {
      case "product.created":
        console.log("Product created", data);
        break;
      case "product.updated":
        console.log("Product updated", data);
        break;
      default:
        console.log("Unhandled event", event);
    }

    res.json(data);
  } catch (error) {
    console.error("Error", error);
    res.status(500).json({ error: error.message });
  }
});