Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Developer Preview — The External Integration API is not generally available. Endpoints and authentication services are not yet open for public integration.
DEC-WH-S01 HMAC-SHA256 verification for outbound deliveries.
1Funnel-Webhook-Id1Funnel-Webhook-Timestamp (Unix epoch seconds)1Funnel-Webhook-Signature (v1=<lowercase_hex>)timestamp + "." + raw_request_body.
Replay tolerance: ±5 minutes. Compare digests in constant time. Preserve the
raw body — do not re-serialize JSON before verification.
import crypto from "node:crypto";
function verify({ rawBody, timestamp, signatureHeader, secret }) {
if (!signatureHeader.startsWith("v1=")) return false;
const provided = signatureHeader.slice(3);
const expected = crypto
.createHmac("sha256", secret)
.update(`${timestamp}.${rawBody}`, "utf8")
.digest("hex");
const a = Buffer.from(provided, "utf8");
const b = Buffer.from(expected, "utf8");
return a.length === b.length && crypto.timingSafeEqual(a, b);
}