Terminal Shipping API
Ask or search…
K

Handling Webhook Events

Sample code for handling webhook events in Node.js.

Handling Events (Node.js)

The below example illustrates how to securely handle webhook events within your own applications. Each webhook call from the API includes a secure X-Terminal-Signature which is generated using your SECRET_KEY. To ensure integrity of each request you receive, you can complete a simple verification task as shown in the example below:
const crypto = require('crypto');
const SECRET_KEY = ""; //Your secret key
// Handle webhook event
const handleEvent = (req, res) => {
try{
res.sendStatus(200);
let webhook_signature = req.headers['X-Terminal-Signature']; //retrieve the request signature
let {body} = req; // Retrieve the request's body
let request_validation = verifyWebhookRequest(webhook_signature, SECRET_KEY, body); //Validate webhook request
if(request_validation.status){
let {data, event} = body; //retrieve event type and data payload
switch(event){
case "shipment.created":
//Handle successful shipment creation event
break;
case "address.updated":
//Handle successful address update event
break;
default:
//Handle unknown event received
}
}else{
//request is not valid API webhook
}
}catch(e){
console.log("Error occurred - %O", e)
}
}
/**
* Verifies validity of webhook request.
* @params - signature - Signature hash received via webhook.
* @params - secret_key - API secret key.
* @params - body - Request payload received via webhook.
*/
const verifyWebhookRequest = (signature, secret_key, body={}) => {
try{
let manual_hash_signature = crypto.createHmac('sha512', secret_key).update(JSON.stringify(body)).digest('hex'); //regenerate hash using secret key and webhook payload
let request_valid = (signature === manual_hash_signature); //verify signature from webhook matches manual hash
let valid_message = (request_valid) ? "Webhook request is valid" : "Invalid webhook request received";
return {
status: request_valid,
message: valid_message
}
}catch(e){
console.log("An error occurred %O", e);
return {
status: false,
message: "Unable to verify request"
}
}
}