Receive webhooks

Goal: get CRM events (record created / updated / deleted) pushed to your endpoint instead of polling. Time: ~10 min.

You need

• A public HTTPS endpoint that returns 200 quickly.
• A webhook registered for your workspace (API keys → Webhooks), which gives you a signing secret.

1. Register an endpoint

Point a webhook at your URL and pick the events you care about (e.g. record.created, record.updated). You'll receive a signing secret — store it.

2. Verify the signature

Every delivery is HMAC-signed. Recompute the signature over the raw body with your secret and compare in constant time before trusting the payload:

import crypto from 'crypto';

function verify(rawBody: string, signature: string, secret: string): boolean {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

app.post('/webhooks/corteksa', (req, res) => {
  if (!verify(req.rawBody, req.header('x-corteksa-signature'), SECRET)) {
    return res.status(401).end();
  }
  enqueue(req.body);   // do the work async
  res.status(200).end(); // ack fast — deliveries retry on non-200
});

3. Respond fast, work async

Return 200 immediately and process in the background. Deliveries retry with backoff on any non-2xx, so make your handler idempotent (dedupe on the event id).

Notes

• This is Corteksa → your app. For provider → Corteksa messaging webhooks (WhatsApp/Facebook replies), see Messaging › Webhooks.
• Full model and event list → the Webhooks guide under Guides › Integrations.