Webhook Processing

FORMTORCH_WEBHOOK_SECRET=your_signing_secret_here

import { createHmac, timingSafeEqual } from "crypto";
 
export async function POST(req: Request) {
  // Read the raw body BEFORE JSON.parse — the signature is over the raw string
  const body = await req.text();
  const signature = req.headers.get("x-formtorch-signature") ?? "";
 
  // Verify the signature
  const expected = `sha256=${createHmac(
    "sha256",
    process.env.FORMTORCH_WEBHOOK_SECRET!
  )
    .update(body)
    .digest("hex")}`;
 
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !timingSafeEqual(a, b)) {
    return new Response("Unauthorized", { status: 401 });
  }
 
  const event = JSON.parse(body) as FormtorchEvent;
 
  switch (event.event) {
    case "form.submitted": {
      const { id, data } = event.submission;
      console.log(`New submission ${id}:`, data);
      // e.g. save to your database, send to CRM, etc.
      break;
    }
    case "form.spam": {
      // optionally log or review spam submissions
      break;
    }
    case "form.test": {
      // test delivery — safe to ignore or log
      break;
    }
  }
 
  return new Response("OK");
}
 
// TypeScript types matching the Formtorch payload shape
type FormtorchEvent = {
  event: "form.submitted" | "form.spam" | "form.test";
  timestamp: string;
  delivery_id: string;
  form: { id: string; name: string };
  submission: {
    id: string;
    created_at: string;
    data: Record<string, unknown>;
    is_test: boolean;
    is_spam: boolean;
  };
};

npm install express

const express = require("express");
const { createHmac, timingSafeEqual } = require("crypto");
 
const router = express.Router();
 
// Use express.raw() to get the raw body for signature verification
router.post(
  "/formtorch",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const body = req.body; // Buffer
    const signature = req.headers["x-formtorch-signature"] ?? "";
 
    const expected = `sha256=${createHmac(
      "sha256",
      process.env.FORMTORCH_WEBHOOK_SECRET
    )
      .update(body)
      .digest("hex")}`;
 
    const a = Buffer.from(signature);
    const b = Buffer.from(expected);
    if (a.length !== b.length || !timingSafeEqual(a, b)) {
      return res.status(401).send("Unauthorized");
    }
 
    const event = JSON.parse(body.toString());
 
    if (event.event === "form.submitted") {
      const { id, data } = event.submission;
      console.log(`New submission ${id}:`, data);
      // your logic here
    }
 
    res.send("OK");
  }
);
 
module.exports = router;

const app = require("express")();
const webhooks = require("./routes/webhooks");
 
app.use("/api/webhooks", webhooks);
 
app.listen(3000);