Webhooks

Request

curl -X POST "https://looptake.com/api/v1/webhooks" \
  -H "Authorization: Bearer $LOOPTAKE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.example/hooks/looptake",
    "events": ["post.published", "post.failed"]
  }'

Python

import hashlib, hmac, time

TOLERANCE = 300

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1 or abs(time.time() - int(t)) > TOLERANCE:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

Node

import { createHmac, timingSafeEqual } from 'node:crypto';

const TOLERANCE = 300;

export function verify(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=', 2)));
  if (!t || !v1 || Math.abs(Date.now() / 1000 - Number(t)) > TOLERANCE) return false;
  const expected = createHmac('sha256', secret).update(`${t}.`).update(rawBody).digest();
  const received = Buffer.from(v1, 'hex');
  return expected.length === received.length && timingSafeEqual(expected, received);
}