Receive WhatsApp webhooks in Node.js

// npm install express
// Adapted from the Webhooks Guide (docs.leadpattern.com/api/webhooks-guide).
const crypto = require("crypto");
const express = require("express");

const app = express();
const SECRET = process.env.LEADPATTERN_WEBHOOK_SECRET; // whsec_... (shown once when you create the webhook)
const TOLERANCE_SEC = 300; // reject deliveries signed more than 5 minutes ago

const sign = (data) => "sha256=" + crypto.createHmac("sha256", SECRET).update(data).digest("hex");

// Constant-time compare that never throws on length mismatch.
function safeEqual(a, b) {
  const ab = Buffer.from(a || "", "utf8");
  const bb = Buffer.from(b || "", "utf8");
  return ab.length === bb.length && crypto.timingSafeEqual(ab, bb);
}
// For 24 h after a secret rotation, deliveries also carry *-Previous signatures — accept either.
const matchesAny = (expected, ...headers) => headers.some((h) => h && safeEqual(h, expected));

const seen = new Set(); // use Redis or your database in production

// IMPORTANT: verify against the RAW body bytes, before any JSON parsing.
app.post("/leadpattern/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const raw = req.body; // Buffer
  const ts = req.get("X-Webhook-Timestamp");
  let ok = false;

  if (ts && req.get("X-Webhook-Signature-V2")) {
    // V2 (recommended): HMAC over "<timestamp>.<raw body>" + freshness check
    const fresh = Math.abs(Date.now() / 1000 - Number(ts)) <= TOLERANCE_SEC;
    ok = fresh && matchesAny(
      sign(`${ts}.${raw.toString("utf8")}`),
      req.get("X-Webhook-Signature-V2"),
      req.get("X-Webhook-Signature-V2-Previous"),
    );
  } else {
    // V1: HMAC over the raw body only
    ok = matchesAny(sign(raw), req.get("X-Webhook-Signature"), req.get("X-Webhook-Signature-Previous"));
  }
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(raw.toString("utf8")); // { id, event, timestamp, data }

  // Events are delivered at least once: deduplicate on id (== X-Webhook-Id)
  if (seen.has(event.id)) return res.sendStatus(200);
  seen.add(event.id);

  // ACK fast (any 2xx within 10 seconds), then do the work
  res.sendStatus(200);
  setImmediate(() => handleEvent(event));
});

function handleEvent({ event, data }) {
  if (event === "test") return; // "Send test" deliveries: data = { message }
  if (event === "message_received") {
    const text = data.message?.content?.text?.body;
    console.log("New message from", data.waId, ":", text);
  }
  // New fields may be added at any time — ignore ones you don't recognise.
}

app.listen(3000);

curl -X POST https://public.leadpattern.com/v2/webhook/register \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Webhook",
    "url": "https://example.com/leadpattern/webhook",
    "webhookEvents": ["message_received", "message_status_update"],
    "generateSecret": true
  }'

# Response (201) includes data.secret ONCE — store it as LEADPATTERN_WEBHOOK_SECRET.
# Before saving, Lead Pattern POSTs a signed "test" event to your URL;
# your endpoint must answer 2xx within 10 seconds, or the request returns 422.

{
  "id": "3f1c2a9e-7b4d-4c1e-9a52-0d6c8e7f1b20",
  "event": "message_received",
  "timestamp": "2026-07-01T10:30:00.000Z",
  "data": {
    "waId": "91XXXXXXXXXX",
    "message": {
      "waId": "91XXXXXXXXXX",
      "messageId": "wamid.HBgMOTE5OTk5OTk5OTk5FQIAEhgg",
      "direction": "incoming",
      "type": "text",
      "content": { "text": { "body": "Hi, is the Pro plan available?" } },
      "status": "received",
      "statusTimestamp": "2026-07-01T10:29:58.000Z",
      "timestamp": "2026-07-01T10:29:58.000Z",
      "replyTo": null
    },
    "contact": {
      "waId": "91XXXXXXXXXX",
      "bsuid": null,
      "username": null,
      "name": { "first": "First", "last": "Last" },
      "profileName": "First",
      "phone": "XXXXXXXXXX",
      "countryCode": "91",
      "status": "open",
      "optOut": false,
      "assignedTo": { "id": "664abc123def456789000001", "name": "Agent name" },
      "tags": [ { "id": "664abc123def456789000aaa", "name": "Hot lead", "color": "#6366f1" } ],
      "customAttributes": [ { "slug": "city", "value": "Pune" } ]
    },
    "wabaNumber": "91XXXXXXXXXX"
  }
}

// Reply to an incoming message — the customer just wrote, so the 24-hour window is open
// and a free-form text message is allowed.
async function handleEvent({ event, data }) {
  if (event !== "message_received" || !data.waId) return; // BSUID contacts have bsuid instead of waId
  const res = await fetch("https://public.leadpattern.com/whatsapp/message/text", {
    method: "POST",
    headers: {
      Authorization: process.env.LEADPATTERN_API_KEY, // raw key, no "Bearer " prefix
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      to: "+" + data.waId,
      content: { text: "Thanks for your message! Our team will reply shortly." },
    }),
  });
  if (res.status !== 201) console.error("Reply failed", res.status, await res.text());
}