Authorization: Bearer your-api-key-here
X-API-Key: your-secret-key

// Verify webhook signature
const signature = req.headers['x-webhook-signature'];
const payload = JSON.stringify(req.body);
const expectedSignature = crypto
  .createHmac('sha256', webhookSecret)
  .update(payload)
  .digest('hex');

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

// Middleware to verify webhooks
app.use('/webhook/*', (req, res, next) => {
  const signature = req.headers['x-webhook-signature'];
  const payload = JSON.stringify(req.body);
  
  if (!verifyWebhookSignature(payload, signature, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  next();
});

const rateLimit = require('express-rate-limit');

const webhookLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 1000, // Limit each IP to 1000 requests per windowMs
  message: 'Too many webhook requests'
});

app.use('/webhook', webhookLimiter);

// ✅ Correct - HTTPS endpoint
const webhookUrl = 'https://api.yoursite.com/webhook/ai-sync';

// ❌ Incorrect - HTTP endpoint (insecure)
const webhookUrl = 'http://api.yoursite.com/webhook/ai-sync';

app.post('/webhook', (req, res) => {
  try {
    // Process webhook data
    processWebhookData(req.body);
    
    // Success response
    res.status(200).json({ 
      received: true,
      timestamp: new Date().toISOString()
    });
  } catch (error) {
    // Log error for debugging
    console.error('Webhook processing error:', error);
    
    // Return error status
    res.status(500).json({ 
      error: 'Internal processing error',
      message: error.message
    });
  }
});

# Install ngrok
npm install -g ngrok

# Start your local server
node webhook-server.js

# Expose local server
ngrok http 3000

# Use the HTTPS URL for webhook configuration
# https://abc123.ngrok.io/webhook

curl -X POST https://your-webhook-url.com/webhook \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Signature: sha256=test-signature" \
  -d '{
    "event": "call.ended",
    "timestamp": "2025-01-15T14:30:25.123Z",
    "data": {
      "call_id": "test_call_123",
      "call_duration": 120,
      "sentiment": "positive"
    }
  }'