├ 11

webhooks

Configure a webhook URL on your app and edgepush will POST every state change to your endpoint with an HMAC-SHA256 signature over the raw body. No polling required.

POST /your/webhook  HTTP/1.1
x-edgepush-event:     message.delivered
x-edgepush-signature: sha256=9f86d081...
x-edgepush-id:        evt_01HX2A9P4M
content-type:         application/json

{
  "event": "message.delivered",
  "messageId": "tk_01HX2A9P4M",
  "appId": "app_...",
  "status": "delivered",
  "error": null,
  "tokenInvalid": false,
  "timestamp": 1744386512000
}

Verify the signature in your handler:

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(body: string, sigHeader: string, secret: string) {
  const expected = createHmac("sha256", secret)
    .update(body)
    .digest("base64");
  const provided = sigHeader.replace(/^sha256=/, "");
  return timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(provided),
  );
}