Webhook Signature Verification Code Generator (Node.js)

const express = require('express');
const crypto = require('crypto');

const app = express();

// Keep the raw bytes: the signature is computed over the exact body Meta sent.
app.use('/webhooks/whatsapp', express.raw({ type: 'application/json', limit: '1mb' }));

// 1. Verification handshake (GET)
app.get('/webhooks/whatsapp', function (req, res) {
  const mode = req.query['hub.mode'];
  const token = req.query['hub.verify_token'];
  const challenge = req.query['hub.challenge'];
  if (mode === 'subscribe' && token === process.env.WEBHOOK_VERIFY_TOKEN) {
    return res.status(200).send(challenge);
  }
  return res.sendStatus(403);
});

// 2. Event delivery (POST)
app.post('/webhooks/whatsapp', function (req, res) {
  const header = req.get('X-Hub-Signature-256') || '';
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.META_APP_SECRET)
    .update(req.body)
    .digest('hex');

  const a = Buffer.from(header);
  const b = Buffer.from(expected);
  const valid = a.length === b.length && crypto.timingSafeEqual(a, b);
  if (!valid) {
    return res.sendStatus(401);
  }

  // Acknowledge fast, process later.
  res.sendStatus(200);
  let payload;
  try {
    payload = JSON.parse(req.body.toString('utf8'));
  } catch (err) {
    return;
  }
  enqueueEvent(payload);
});

function enqueueEvent(payload) {
  // Push to a durable queue here (database table, Redis stream, SQS, etc.).
  console.log('event received', JSON.stringify(payload).length, 'bytes');
}

app.listen(3000, function () {
  console.log('webhook receiver listening on 3000');
});

# Compute a signature for a sample body and send it
BODY='{"object":"whatsapp_business_account","entry":[]}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$APP_SECRET" | sed 's/^.* //')
curl -i -X POST http://localhost:3000/webhooks/whatsapp -H 'Content-Type: application/json' -H "X-Hub-Signature-256: sha256=$SIG" -d "$BODY"