Partner webhooks

{
  "type": "connection.activated",
  "id": "<stable event ID>",
  "subtotal_client_id": "<installing dashboard team ID>",
  "payload": {
    // Event-specific fields omitted
  }
}

signed_payload = X-Subtotal-Timestamp + "." + raw_body

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifySubtotalWebhook({ rawBody, timestamp, signature, secrets }) {
  if (!/^\d+$/.test(timestamp) || !/^[0-9a-f]{64}$/.test(signature)) {
    return false;
  }

  const received = Buffer.from(signature, "hex");
  const signedPayload = `${timestamp}.${rawBody}`;

  return secrets.some((secret) => {
    const expected = createHmac("sha256", secret)
      .update(signedPayload, "utf8")
      .digest();
    return expected.length === received.length &&
      timingSafeEqual(expected, received);
  });
}