Webhooks

​

How to configure webhooks

1. Log in to your Gojiberry AI account at https://app.gojiberry.ai
2. Navigate to the Integrations page at https://app.gojiberry.ai/integrations
3. Add a Webhook integration by clicking the Webhook option
4. Enter your webhook URL where you want to receive notifications
5. Save the configuration

• A new contact is created
• A contact is updated
• Other relevant events occur in your account

​

Verifying webhook signatures (optional)

• x-gojiberry-timestamp: the Unix timestamp (in seconds) at which the request was sent
• x-gojiberry-signature: sha256= followed by the hex-encoded HMAC-SHA256 of {timestamp}.{rawBody} computed with your signing secret

1. Read the raw request body as a string (do not re-serialize parsed JSON).
2. Concatenate the value of x-gojiberry-timestamp, a . character, and the raw body.
3. Compute the HMAC-SHA256 of that string using your signing secret, hex-encoded, and prefix it with sha256=.
4. Compare it to x-gojiberry-signature using a constant-time comparison.
5. Reject requests whose timestamp is too old (we recommend a 5 minute tolerance) to prevent replay attacks.

const crypto = require('crypto');

function verifyGojiberrySignature(rawBody, headers, secret) {
  const timestamp = headers['x-gojiberry-timestamp'];
  const signature = headers['x-gojiberry-signature'];
  if (!timestamp || !signature) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(timestamp + '.' + rawBody).digest('hex');
  return expected.length === signature.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}