Webhooks

// Node.js 18+, no dependencies. MULTILISTADO_WEBHOOK_SECRET = the secret from the portal.
import http from 'node:http';
import crypto from 'node:crypto';

const SECRET = process.env.MULTILISTADO_WEBHOOK_SECRET;

function validSignature(rawBody, header) {
  const expected = 'sha256=' + crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex');
  const a = Buffer.from(String(header || '')), b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

http.createServer((req, res) => {
  const chunks = [];
  req.on('data', c => chunks.push(c));
  req.on('end', () => {
    const raw = Buffer.concat(chunks);                       // raw bytes: do not use JSON.stringify(req.body)
    if (!validSignature(raw, req.headers['x-pbm-signature'])) { res.writeHead(401).end('bad signature'); return; }
    const evt = JSON.parse(raw.toString('utf8'));
    console.log(evt.event, evt.data.id);                     // store it in your CRM (in the background)
    res.writeHead(200).end('ok');                            // answer fast (under 10 s)
  });
}).listen(process.env.PORT || 3000);

<?php
// webhook.php — PHP 7.4+. MULTILISTADO_WEBHOOK_SECRET = the secret from the portal.
$secret = getenv('MULTILISTADO_WEBHOOK_SECRET');
$raw = file_get_contents('php://input');                     // raw body
$header = $_SERVER['HTTP_X_PBM_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);

if (!hash_equals($expected, $header)) {
    http_response_code(401);
    exit('bad signature');
}
$evt = json_decode($raw, true);
error_log($evt['event'] . ' ' . ($evt['data']['id'] ?? ''));   // store it in your CRM
http_response_code(200);
echo 'ok';

# Flask (pip install flask). MULTILISTADO_WEBHOOK_SECRET = the secret from the portal.
import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["MULTILISTADO_WEBHOOK_SECRET"].encode()

@app.post("/hooks/multilistado")
def multilistado_hook():
    raw = request.get_data()                                 # raw bytes
    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-PBM-Signature", "")):
        abort(401)
    evt = request.get_json()
    print(evt["event"], evt["data"].get("id"))               # store it in your CRM
    return "ok", 200