Webhook Processing

FORMTORCH_WEBHOOK_SECRET=whsec_your_secret_here

import { createHmac } from "crypto";
 
export async function POST(req: Request) {
  const body = await req.text();
  const signature = req.headers.get("x-formtorch-signature") ?? "";
 
  // Verify the signature
  const expected = `sha256=${createHmac(
    "sha256",
    process.env.FORMTORCH_WEBHOOK_SECRET!
  )
    .update(body)
    .digest("hex")}`;
 
  if (signature !== expected) {
    return new Response("Unauthorized", { status: 401 });
  }
 
  // Parse the payload
  const event = JSON.parse(body) as FormtorchEvent;
 
  // Handle by event type (currently only submission.created)
  if (event.type === "submission.created") {
    const { formId, submissionId, fields, submittedAt, isSpam } = event.data;
 
    // Skip spam
    if (isSpam) {
      return new Response("OK");
    }
 
    console.log(`New submission for form ${formId}:`, fields);
 
    // Your logic here: save to DB, send notification, etc.
  }
 
  return new Response("OK");
}
 
type FormtorchEvent = {
  type: "submission.created";
  data: {
    formId: string;
    submissionId: string;
    fields: Record<string, string>;
    submittedAt: string;
    isSpam: boolean;
    spamScore: number;
  };
};

npm install express

const express = require("express");
const { createHmac } = require("crypto");
 
const router = express.Router();
 
// Use express.raw() to get the raw body for signature verification
router.post(
  "/formtorch",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const body = req.body;
    const signature = req.headers["x-formtorch-signature"] ?? "";
 
    const expected = `sha256=${createHmac(
      "sha256",
      process.env.FORMTORCH_WEBHOOK_SECRET
    )
      .update(body)
      .digest("hex")}`;
 
    if (signature !== expected) {
      return res.status(401).send("Unauthorized");
    }
 
    const event = JSON.parse(body.toString());
 
    if (event.type === "submission.created") {
      const { formId, submissionId, fields, isSpam } = event.data;
 
      if (!isSpam) {
        console.log(`New submission for form ${formId}:`, fields);
        // Your logic here
      }
    }
 
    res.send("OK");
  }
);
 
module.exports = router;

const app = require("express")();
const webhooks = require("./routes/webhooks");
 
app.use("/api/webhooks", webhooks);
 
app.listen(3000);