├ 11
webhooks
Configure a webhook URL on your app and edgepush will POST every state change to your endpoint with an HMAC-SHA256 signature over the raw body. No polling required.
POST /your/webhook HTTP/1.1
x-edgepush-event: message.delivered
x-edgepush-signature: sha256=9f86d081...
x-edgepush-id: evt_01HX2A9P4M
content-type: application/json
{
"event": "message.delivered",
"messageId": "tk_01HX2A9P4M",
"appId": "app_...",
"status": "delivered",
"error": null,
"tokenInvalid": false,
"timestamp": 1744386512000
}Verify the signature in your handler:
import { createHmac, timingSafeEqual } from "node:crypto";
function verify(body: string, sigHeader: string, secret: string) {
const expected = createHmac("sha256", secret)
.update(body)
.digest("base64");
const provided = sigHeader.replace(/^sha256=/, "");
return timingSafeEqual(
Buffer.from(expected),
Buffer.from(provided),
);
}