Webhook Verification

npm install @borough/sdk standardwebhooks

import express from "express";
import { webhookMiddleware } from "@borough/sdk/webhooks/express";

type BoroughEventData = {
  listingId: string;
  oldValue: string | null;
  newValue: string;
};

const app = express();

app.post(
  "/webhooks/borough",
  // IMPORTANT: Use raw body parser — signature is verified against the raw body
  express.raw({ type: "application/json" }),
  webhookMiddleware(process.env.BOROUGH_WEBHOOK_SECRET!, async (event) => {
    const data = event.data as BoroughEventData;
    switch (event.type) {
      case "listing.price_decreased":
        console.log(`Listing ${data.listingId} price dropped to ${data.newValue}`);
        break;
      case "listing.created":
        console.log(`New listing: ${data.listingId}`);
        break;
      case "listing.status_changed":
        // Currently a relisting: OFF_MARKET → ACTIVE
        console.log(`Listing ${data.listingId}: ${data.oldValue} → ${data.newValue}`);
        break;
    }
  })
);

app.listen(3000);

// app/api/webhooks/borough/route.ts
import { webhookHandler } from "@borough/sdk/webhooks/nextjs";

export const POST = webhookHandler(
  process.env.BOROUGH_WEBHOOK_SECRET!,
  async (event) => {
    const data = event.data as { listingId: string; oldValue: string | null; newValue: string };
    switch (event.type) {
      case "listing.price_decreased":
        // Send alert, update database, etc.
        await notifyUser(data.listingId, data.newValue);
        break;
      case "listing.expired":
        await removeFromWatchlist(data.listingId);
        break;
    }
  }
);

interface BoroughWebhookEvent {
  type: string; // one of the event types above
  data: {
    listingId: string;
    oldValue: string | null;
    newValue: string;
  };
  timestamp: string; // UTC, "YYYY-MM-DD HH:MM:SS" with no zone suffix
}

import { Webhook } from "standardwebhooks";

const wh = new Webhook(process.env.BOROUGH_WEBHOOK_SECRET!);

// headers: webhook-id, webhook-timestamp, webhook-signature
// body: raw request body as string
try {
  const event = wh.verify(body, {
    "webhook-id": headers["webhook-id"],
    "webhook-timestamp": headers["webhook-timestamp"],
    "webhook-signature": headers["webhook-signature"],
  });
  // event is verified and safe to process
} catch (err) {
  // Signature verification failed — reject the request
  return new Response("Invalid signature", { status: 401 });
}