Ship an AI support agent in 5 minutes

{
  "messageId": "6d1f0c6e-3b7a-4f0e-9a52-8c1e2d4b7a90",
  "role": "system",
  "content": "Message received. Preparing a response...",
  "createdAt": "2026-04-14T10:22:03.412Z",
  "status": "queued"
}

{
  "event": "session.closed",
  "timestamp": "2026-04-14T10:22:03.412Z",
  "data": {
    "sessionId": "sess_3f2a...",
    "chatbotId": "bot_123"
  }
}

// Node.js (Express) — verify a Conviro webhook
import crypto from 'crypto';

// The RAW body is required. express.json() parses and discards it, and
// JSON.stringify(req.body) does NOT reproduce the signed bytes — key
// order and whitespace both change the digest.
app.post('/conviro/webhook',
  express.raw({ type: 'application/json', limit: '1mb' }),
  (req, res) => {
    if (!verify(req.body, req.header('X-Webhook-Signature'))) {
      return res.status(401).end();
    }
    res.status(200).end();            // acknowledge within 10s
    void handle(JSON.parse(req.body.toString('utf8')));
  });

const TOLERANCE_SECONDS = 300;

function verify(rawBody, header) {
  if (!header) return false;

  // Header format: t=<unix_seconds>,v1=<hex_digest>
  const parts = new Map(header.split(',').map((p) => {
    const i = p.indexOf('=');
    return [p.slice(0, i).trim(), p.slice(i + 1).trim()];
  }));
  const timestamp = parts.get('t');
  const signature = parts.get('v1');
  if (!timestamp || !signature) return false;

  // Replay window: without it, a captured payload is valid forever.
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!Number.isFinite(age) || age > TOLERANCE_SECONDS) return false;

  // The digest covers "<timestamp>.<rawBody>" — NOT the body on its own.
  const expected = crypto
    .createHmac('sha256', process.env.CONVIRO_WEBHOOK_SECRET)
    .update(timestamp + '.')
    .update(rawBody)
    .digest('hex');

  const a = Buffer.from(signature, 'utf8');
  const b = Buffer.from(expected, 'utf8');
  // timingSafeEqual throws on a length mismatch, so check length first.
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}