Verifying Signatures

{webhook-id}.{webhook-timestamp}.{raw request body}

curl -X GET "https://api.meetergo.com/webhooks/signing-secret" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "x-meetergo-api-user-id: {userId}"

{
  "secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw",
  "previousSecretExpiresAt": null
}

const crypto = require('node:crypto');
const express = require('express');

const SECRET = process.env.MEETERGO_WEBHOOK_SECRET; // whsec_...
const TOLERANCE_SECONDS = 5 * 60;

function verifyMeetergoWebhook(rawBody, headers) {
  const id = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signatures = headers['webhook-signature'];
  if (!id || !timestamp || !signatures) return false;

  // Replay protection: reject anything older or newer than 5 minutes.
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > TOLERANCE_SECONDS) return false;

  const key = Buffer.from(SECRET.slice('whsec_'.length), 'base64');
  const expected = crypto
    .createHmac('sha256', key)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest();

  // Several signatures are sent while a rotated secret is still valid.
  return signatures.split(' ').some((entry) => {
    const [version, signature] = entry.split(',');
    if (version !== 'v1' || !signature) return false;
    const actual = Buffer.from(signature, 'base64');
    return (
      actual.length === expected.length &&
      crypto.timingSafeEqual(actual, expected)
    );
  });
}

const app = express();

// express.raw keeps the body as the exact bytes meetergo signed.
app.post(
  '/webhooks/meetergo',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const rawBody = req.body.toString('utf8');
    if (!verifyMeetergoWebhook(rawBody, req.headers)) {
      return res.status(401).send('Invalid signature');
    }

    const payload = JSON.parse(rawBody);
    console.log('Verified event:', payload.webhookType);
    res.status(200).send('OK');
  },
);

app.listen(3000);

curl -X POST "https://api.meetergo.com/webhooks/signing-secret/rotate" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "x-meetergo-api-user-id: {userId}"