Jenis Event Webhook

Content-Type: application/json
User-Agent: NgirimWA-Webhook/1.0
X-NgirimWA-Event: message.received
X-NgirimWA-Delivery: 7f2c1d0e-3b4a-4c5d-9e8f-0a1b2c3d4e5f
X-NgirimWA-Signature: t=1758182400,v1=5f1c...   (hanya bila secret diatur)

{
  "event": "message.received",
  "timestamp": "2026-05-15T10:00:00.000Z",
  "device": {
    "id": "uuid-device",
    "name": "Toko Saya",
    "phone": "628111111111"
  },
  "message": {
    "id": "3EB0ABC123",
    "from": "628222222222",
    "sender_name": "Budi",
    "type": "text",
    "content": "Halo, saya mau tanya",
    "info": {},
    "timestamp": 1747300800,
    "raw": { /* objek message Baileys mentah */ }
  },
  "metadata": {
    "is_group": false,
    "group_id": null,
    "is_lid_only": false
  }
}

{
  "event": "message.sent",
  "timestamp": "2026-05-15T10:00:01.123Z",
  "device": { "id": "...", "name": "...", "phone": "628111111111" },
  "message": {
    "id":   "3EB0XYZ789",
    "to":   "628222222222",
    "ack":  2
  }
}

{
  "event": "message.delivered",
  "timestamp": "...",
  "device": { "id": "...", "name": "...", "phone": "..." },
  "message": { "id": "3EB0XYZ789", "to": "628222222222", "ack": 3 }
}

{
  "event": "message.read",
  "timestamp": "...",
  "device": { "id": "...", "name": "...", "phone": "..." },
  "message": { "id": "3EB0XYZ789", "to": "628222222222", "ack": 4 }
}

{
  "event": "message.failed",
  "timestamp": "...",
  "device": { "id": "...", "name": "...", "phone": "..." },
  "message": {
    "id":  "3EB0XYZ789",
    "to":  "628222222222",
    "ack": "failed",
    "error": {
      "code": 408,
      "message": "Recipient not reachable"
    }
  }
}

{
  "event": "device.connected",
  "timestamp": "2026-05-15T10:00:00.000Z",
  "device": {
    "id":    "uuid-device",
    "name":  "Toko Saya",
    "phone": "628111111111"
  }
}

{
  "event": "device.disconnected",
  "timestamp": "...",
  "device": {
    "id":    "uuid-device",
    "name":  "Toko Saya",
    "phone": "628111111111"
  },
  "reason": "loggedOut",
  "code":   401
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.NGIRIMWA_WEBHOOK_SECRET;

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-NgirimWA-Signature') || '';
  const parts = Object.fromEntries(header.split(',').map((kv) => kv.split('=')));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return res.status(401).end();

  const expected = crypto.createHmac('sha256', SECRET).update(`${t}.${req.body}`).digest('hex');
  const given = Buffer.from(parts.v1 || '', 'hex');
  if (given.length !== 32 || !crypto.timingSafeEqual(given, Buffer.from(expected, 'hex'))) {
    return res.status(401).end();
  }

  const payload = JSON.parse(req.body);
  // dedup: simpan req.get('X-NgirimWA-Delivery'), abaikan bila sudah pernah diproses
  res.sendStatus(200);
  // ... proses payload setelah membalas
});

<?php
$secret  = getenv('NGIRIMWA_WEBHOOK_SECRET');
$raw     = file_get_contents('php://input');
$header  = $_SERVER['HTTP_X_NGIRIMWA_SIGNATURE'] ?? '';
parse_str(str_replace(',', '&', $header), $parts); // ['t' => '1758182400', 'v1' => '...']

$t = (int) ($parts['t'] ?? 0);
if ($t === 0 || abs(time() - $t) > 300) { http_response_code(401); exit; }

$expected = hash_hmac('sha256', $t . '.' . $raw, $secret);
if (!hash_equals($expected, $parts['v1'] ?? '')) { http_response_code(401); exit; }

http_response_code(200);
$payload = json_decode($raw, true);
// dedup dengan $_SERVER['HTTP_X_NGIRIMWA_DELIVERY'], lalu proses $payload