API Reference

import crypto from "crypto";

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(JSON.stringify(payload))
    .digest("hex");

  const sig = signature.replace("sha256=", "");

  return crypto.timingSafeEqual(
    Buffer.from(sig, "hex"),
    Buffer.from(expected, "hex")
  );
}

// In your webhook handler:
app.post("/webhook", (req, res) => {
  const signature = req.headers["x-broadcaster-signature"];
  const isValid = verifyWebhook(
    req.body,
    signature,
    process.env.WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).send("Invalid signature");
  }

  // Process the message
  const { message } = req.body;
  console.log(`New ${message.channel} from ${message.from}`);

  res.status(200).send("OK");
});

import hmac
import hashlib
import json

def verify_webhook(payload, signature, secret):
    expected = hmac.new(
        secret.encode("utf-8"),
        json.dumps(payload).encode("utf-8"),
        hashlib.sha256
    ).hexdigest()

    sig = signature.replace("sha256=", "")

    return hmac.compare_digest(sig, expected)

# In your webhook handler (Flask example):
@app.route("/webhook", methods=["POST"])
def webhook():
    signature = request.headers.get(
        "X-Broadcaster-Signature"
    )
    is_valid = verify_webhook(
        request.json,
        signature,
        os.environ["WEBHOOK_SECRET"]
    )

    if not is_valid:
        return "Invalid signature", 401

    # Process the message
    message = request.json["message"]
    print(f"New {message['channel']} from {message['from']}")

    return "OK", 200