Events you can trust.

# What we POST to your endpoint
// X-Email-Digit-Signature: sha256=abc...,t=1748459269
// X-Email-Digit-Event: reply.received
// X-Email-Digit-Event-Id: 00000000-0000-0000-0000-000000000000
// X-Email-Digit-Delivery-Id: 00000000-0000-0000-0000-000000000000
// X-Email-Digit-Attempt: 1

{
  "id": "00000000-0000-0000-0000-000000000000",
  "type": "reply.received",
  "created_at": "2026-05-28T14:21:09Z",
  "data": {
    "reply_id": "rep_amelia_9k2",
    "from_email": "amelia@stripe.com",
    "subject": "Re: your demo",
    "intent": "interested",
    "sentiment": 0.78,
    "confidence": 0.94,
    "channel": "email"
  }
}

import crypto from "crypto";
import express from "express";

const SECRET = process.env.ED_WEBHOOK_SECRET;

function verify(rawBody, header) {
  const [sigPart, tsPart] = header.split(",");
  const sig = sigPart.slice("sha256=".length);
  const ts = tsPart.slice("t=".length);
  // Reject anything older than 5 minutes (replay defense)
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = crypto.createHmac("sha256", SECRET)
    .update(`${ts}.`).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

// IMPORTANT: use express.raw — JSON parsers break the MAC
app.post("/webhooks/email-digit",
  express.raw({ type: "application/json" }),
  (req, res) => {
    if (!verify(req.body, req.get("X-Email-Digit-Signature"))) {
      return res.status(401).send("invalid");
    }
    const event = JSON.parse(req.body.toString("utf8"));
    // dispatch on event.type
    res.status(200).send("ok");
  });