SMS Delivery Status WebhooksKnow the moment every SMS is delivered

import crypto from "node:crypto";
import express from "express";

const app = express();
const WEBHOOK_SECRET = process.env.CRAZYTEL_SMS_WEBHOOK_SECRET; // 64-char string

app.post(
  "/crazytel/sms-status",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("X-CrazyAPI-Signature") || "";
    const timestamp = req.header("X-CrazyAPI-Timestamp") || "";

    // 1. Reject timestamps older than 5 minutes
    const skewSeconds = Math.abs(Date.now() / 1000 - Number(timestamp));
    if (!Number.isFinite(skewSeconds) || skewSeconds > 300) {
      return res.status(400).send("Stale or invalid timestamp");
    }

    // 2. Compute HMAC-SHA256 over "<timestamp>.<raw_body>"
    const expected = crypto
      .createHmac("sha256", WEBHOOK_SECRET)
      .update(`${timestamp}.`)
      .update(req.body)
      .digest("hex");

    // 3. Constant-time signature check
    const valid =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
    if (!valid) {
      return res.status(400).send("Invalid signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    // Deduplicate on event.event_id, match message via event.message_uuid
    console.log(`Message ${event.message_uuid} -> ${event.status}`);
    return res.status(204).end();
  }
);

<?php
$secret = getenv('CRAZYTEL_SMS_WEBHOOK_SECRET');
$signature = $_SERVER['HTTP_X_CRAZYAPI_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_CRAZYAPI_TIMESTAMP'] ?? '';

if (!ctype_digit($timestamp) || abs(time() - (int)$timestamp) > 300) {
    http_response_code(400);
    exit('Stale or invalid timestamp');
}

$rawBody = file_get_contents('php://input');
$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(400);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
// Deduplicate on $event['event_id'], update message $event['message_uuid']
http_response_code(204);

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
	"strconv"
	"time"
)

func verifyCrazytelWebhook(secret string, w http.ResponseWriter, r *http.Request) ([]byte, bool) {
	body, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "bad body", http.StatusBadRequest)
		return nil, false
	}
	ts := r.Header.Get("X-CrazyAPI-Timestamp")
	tsInt, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || abs64(time.Now().Unix()-tsInt) > 300 {
		http.Error(w, "stale timestamp", http.StatusBadRequest)
		return nil, false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(ts))
	mac.Write([]byte{'.'})
	mac.Write(body)
	expected := hex.EncodeToString(mac.Sum(nil))
	sig := r.Header.Get("X-CrazyAPI-Signature")
	if !hmac.Equal([]byte(sig), []byte(expected)) {
		http.Error(w, "invalid signature", http.StatusBadRequest)
		return nil, false
	}
	return body, true
}

func abs64(x int64) int64 {
	if x < 0 {
		return -x
	}
	return x
}