Webhooks

POST /webhooks/talkingdot HTTP/1.1
Host: www.example.com
Content-Type: application/json
X-TalkingDot-Event: message.created
X-TalkingDot-Delivery: 70412
X-TalkingDot-Signature: t=1791018900,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

{
  "id": "evt_4f1c9a27d03b5e8a61c2",
  "event": "message.created",
  "workspace_id": 12,
  "created_at": "2026-10-03T09:15:00Z",
  "data": {
    "message": {
      "id": 88213,
      "conversation_id": 5531,
      "type": "message",
      "author_type": "contact",
      "author": { "id": 1842 },
      "body": "Thanks! I've just paid it.",
      "attachments": [],
      "via": "widget",
      "created_at": "2026-10-03T09:15:00Z"
    },
    "conversation": {
      "id": 5531,
      "number": 318,
      "contact_id": 1842,
      "status": "open",
      "priority": false,
      "assignee_id": 7,
      "team_id": 2,
      "channel": "chat",
      "started_by": "contact",
      "subject": null,
      "source_url": "https://www.example.com/pricing",
      "tags": [
        { "id": 5, "name": "billing" }
      ],
      "rating": null,
      "first_response_seconds": 94,
      "snoozed_until": null,
      "waiting_since": "2026-10-03T09:15:00Z",
      "last_message_at": "2026-10-03T09:15:00Z",
      "created_at": "2026-10-03T09:01:30Z",
      "closed_at": null,
      "url": "https://talkingdot.com/app/12/inbox/5531"
    }
  }
}

<?php
// webhook.php
$secret    = (string) getenv('TALKINGDOT_WEBHOOK_SECRET');
$payload   = file_get_contents('php://input');            // raw body
$signature = $_SERVER['HTTP_X_TALKINGDOT_SIGNATURE'] ?? '';

$parts = [];
foreach (explode(',', $signature) as $pair) {
    [$key, $value] = array_pad(explode('=', trim($pair), 2), 2, '');
    $parts[$key] = $value;
}
$t  = $parts['t'] ?? '';
$v1 = $parts['v1'] ?? '';

$expected = hash_hmac('sha256', $t . '.' . $payload, $secret);

if (!ctype_digit($t) || abs(time() - (int) $t) > 300 || !hash_equals($expected, $v1)) {
    http_response_code(400);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

// Skip events you've already handled (see "Handle duplicates"), then queue the work.
error_log('Received ' . $event['event'] . ' ' . $event['id']);

http_response_code(200);

const crypto = require('crypto');
const express = require('express');

const app = express();
const SECRET = process.env.TALKINGDOT_WEBHOOK_SECRET;

function isValidSignature(rawBody, header) {
  const parts = {};
  for (const pair of String(header || '').split(',')) {
    const [key, ...rest] = pair.trim().split('=');
    parts[key] = rest.join('=');
  }
  const t = parts.t || '';
  const v1 = parts.v1 || '';

  if (!/^\d+$/.test(t) || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  if (!/^[0-9a-f]{64}$/.test(v1)) return false;

  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${t}.`)
    .update(rawBody)
    .digest();

  return crypto.timingSafeEqual(expected, Buffer.from(v1, 'hex'));
}

app.post('/webhooks/talkingdot', express.raw({ type: 'application/json' }), (req, res) => {
  if (!Buffer.isBuffer(req.body) || !isValidSignature(req.body, req.get('X-TalkingDot-Signature'))) {
    return res.status(400).send('Invalid signature');
  }

  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(200); // acknowledge quickly...

  // ...then do the work. Skip event.id values you've already handled.
  console.log('Received', event.event, event.id);
});

app.listen(3000);

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["TALKINGDOT_WEBHOOK_SECRET"].encode()


def is_valid_signature(raw_body: bytes, header: str) -> bool:
    parts = dict(p.strip().split("=", 1) for p in header.split(",") if "=" in p)
    t = parts.get("t", "")
    v1 = parts.get("v1", "")

    if not t.isdigit() or abs(time.time() - int(t)) > 300:
        return False

    expected = hmac.new(SECRET, t.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected.encode(), v1.encode())


@app.post("/webhooks/talkingdot")
def talkingdot_webhook():
    raw_body = request.get_data()  # raw bytes; read before parsing JSON
    if not is_valid_signature(raw_body, request.headers.get("X-TalkingDot-Signature", "")):
        abort(400)

    event = request.get_json()
    # Skip event["id"] values you've already handled, then queue the work.
    app.logger.info("Received %s %s", event["event"], event["id"])
    return "", 200

require "json"
require "openssl"
require "rack/utils"
require "sinatra"

SECRET = ENV.fetch("TALKINGDOT_WEBHOOK_SECRET")

def valid_signature?(raw_body, header)
  parts = header.to_s.split(",").map { |pair| pair.strip.split("=", 2) }.select { |pair| pair.length == 2 }.to_h
  t = parts["t"].to_s
  v1 = parts["v1"].to_s

  return false unless t.match?(/\A\d+\z/) && (Time.now.to_i - t.to_i).abs <= 300

  expected = OpenSSL::HMAC.hexdigest("SHA256", SECRET, "#{t}.#{raw_body}")
  Rack::Utils.secure_compare(expected, v1)
end

post "/webhooks/talkingdot" do
  request.body.rewind
  raw_body = request.body.read # raw bytes, before parsing JSON

  halt 400, "Invalid signature" unless valid_signature?(raw_body, request.env["HTTP_X_TALKINGDOT_SIGNATURE"])

  event = JSON.parse(raw_body)
  # Skip event["id"] values you've already handled, then queue the work.
  logger.info("Received #{event["event"]} #{event["id"]}")
  status 200
end

<?php
// After verifying the signature (see above). $pdo is your PDO connection.
// CREATE TABLE processed_webhooks (event_id VARCHAR(64) PRIMARY KEY, received_at DATETIME NOT NULL);
$event = json_decode($payload, true);

$insert = $pdo->prepare('INSERT IGNORE INTO processed_webhooks (event_id, received_at) VALUES (?, UTC_TIMESTAMP())');
$insert->execute([$event['id']]);

if ($insert->rowCount() === 0) {
    http_response_code(200); // already handled
    exit;
}

// First time we've seen this event: handle it.

SECRET='your-endpoint-signing-secret'
BODY='{"id":"evt_00000000000000000001","event":"message.created","workspace_id":12,"created_at":"2026-10-03T09:15:00Z","data":{}}'
T=$(date +%s)
SIG=$(printf '%s' "$T.$BODY" | openssl dgst -sha256 -hmac "$SECRET" | sed 's/^.*= //')

curl -X POST http://localhost:3000/webhooks/talkingdot \
  -H "Content-Type: application/json" \
  -H "X-TalkingDot-Event: message.created" \
  -H "X-TalkingDot-Delivery: 1" \
  -H "X-TalkingDot-Signature: t=$T,v1=$SIG" \
  --data-binary "$BODY"