Webhooks

curl -X POST https://my.flowsign.app/api/v1/webhooks \
  -H "Authorization: Bearer fsk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://api.example.com/webhooks/flowsign",
    "events": ["PACKAGE_COMPLETED", "SESSION_DECLINED"],
    "description": "Production"
  }'

const res = await fetch("https://my.flowsign.app/api/v1/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.FLOWSIGN_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://api.example.com/webhooks/flowsign",
    events: ["PACKAGE_COMPLETED", "SESSION_DECLINED"],
    description: "Production",
  }),
});

const { data } = await res.json();
console.log(data.secret);

import os

import requests

res = requests.post(
    "https://my.flowsign.app/api/v1/webhooks",
    headers={"Authorization": f"Bearer {os.environ['FLOWSIGN_API_KEY']}"},
    json={
        "url": "https://api.example.com/webhooks/flowsign",
        "events": ["PACKAGE_COMPLETED", "SESSION_DECLINED"],
        "description": "Production",
    },
    timeout=30,
)
res.raise_for_status()

print(res.json()["data"]["secret"])

using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json;

using var http = new HttpClient { BaseAddress = new Uri("https://my.flowsign.app") };
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Bearer",
    Environment.GetEnvironmentVariable("FLOWSIGN_API_KEY"));

var res = await http.PostAsJsonAsync("/api/v1/webhooks", new
{
    url = "https://api.example.com/webhooks/flowsign",
    events = new[] { "PACKAGE_COMPLETED", "SESSION_DECLINED" },
    description = "Production",
});
res.EnsureSuccessStatusCode();

var body = await res.Content.ReadFromJsonAsync<JsonElement>();
Console.WriteLine(body.GetProperty("data").GetProperty("secret").GetString());

import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.FLOWSIGN_WEBHOOK_SECRET;

app.post(
  "/webhooks/flowsign",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const timestamp = req.get("x-flowsign-timestamp") ?? "";
    const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
    const expected = Buffer.from(
      createHmac("sha256", SECRET).update(`${timestamp}.`).update(req.body).digest("hex"),
    );
    const valid =
      fresh &&
      (req.get("x-flowsign-signature") ?? "")
        .split(",")
        .map((entry) => entry.trim())
        .filter((entry) => entry.startsWith("v1="))
        .some((entry) => {
          const received = Buffer.from(entry.slice(3));
          return received.length === expected.length && timingSafeEqual(received, expected);
        });

    if (!valid) return res.status(401).end();

    res.status(204).end();

    const payload = JSON.parse(req.body.toString("utf8"));
    handleEvent(req.get("x-flowsign-delivery-id"), payload);
  },
);

import hmac
import os
import time
from hashlib import sha256

from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["FLOWSIGN_WEBHOOK_SECRET"].encode()


@app.post("/webhooks/flowsign")
def flowsign_webhook():
    timestamp = request.headers.get("x-flowsign-timestamp", "")
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        return "", 401

    signed = timestamp.encode() + b"." + request.get_data()
    expected = hmac.new(SECRET, signed, sha256).hexdigest()
    received = [
        entry.strip()[3:]
        for entry in request.headers.get("x-flowsign-signature", "").split(",")
        if entry.strip().startswith("v1=")
    ]

    if not any(hmac.compare_digest(expected, candidate) for candidate in received):
        return "", 401

    enqueue_event(request.headers["x-flowsign-delivery-id"], request.get_json())
    return "", 204

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

var secret = Encoding.UTF8.GetBytes(builder.Configuration["FLOWSIGN_WEBHOOK_SECRET"]!);

app.MapPost("/webhooks/flowsign", async (HttpRequest req) =>
{
    using var buffer = new MemoryStream();
    await req.Body.CopyToAsync(buffer);
    var raw = buffer.ToArray();

    var timestamp = req.Headers["x-flowsign-timestamp"].ToString();
    if (!long.TryParse(timestamp, out var seconds)
        || Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - seconds) > 300)
    {
        return Results.Unauthorized();
    }

    var signed = Encoding.UTF8.GetBytes($"{timestamp}.").Concat(raw).ToArray();
    var expected = Encoding.UTF8.GetBytes(
        Convert.ToHexString(HMACSHA256.HashData(secret, signed)).ToLowerInvariant());

    var valid = req.Headers["x-flowsign-signature"].ToString()
        .Split(',')
        .Select(entry => entry.Trim())
        .Where(entry => entry.StartsWith("v1="))
        .Any(entry => CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(entry[3..]),
            expected));

    if (!valid) return Results.Unauthorized();

    var payload = JsonSerializer.Deserialize<JsonElement>(raw);
    EnqueueEvent(req.Headers["x-flowsign-delivery-id"].ToString(), payload);

    return Results.NoContent();
});

app.Run();