Let your systems talk. Let operations move faster.

curl https://api.reach2x.com/v1/webhooks \
  -H "Authorization: Bearer $REACH2X_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/2x",
    "events": ["sms.delivered", "sms.failed", "email.delivered", "email.failed"]
  }'

{
  "webhook": {
    "id": "1b2c3d4e-5f60-4a7b-8c9d-0e1f2a3b4c5d",
    "url": "https://example.com/hooks/2x",
    "status": "active",
    "secret_prefix": "whsec_9fK2"
  },
  "secret": "whsec_… (shown only once)"
}

import crypto from 'node:crypto';

// header "x-imza": t=<unix seconds>,v1=<hex>
export function verify(rawBody, header, secret) {
  const p = Object.fromEntries(header.split(',').map((x) => x.split('=')));
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${p.t}.${rawBody}`)
    .digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(p.t)) <= 300;
  return (
    fresh &&
    expected.length === p.v1?.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(p.v1))
  );
}