Webhooks

{
  "id": "evt_01J3xkx7...",
  "type": "message.delivered",
  "createdAt": "2026-04-21T08:12:43.120Z",
  "data": {
    "messageId": "msg_01J3...",
    "phone": "+919876543210",
    "deliveredAt": "2026-04-21T08:12:42.948Z"
  }
}

import { verifyWebhookSignature } from 'zaptick/webhooks';

export async function POST(req: Request) {
  const payload   = await req.text();
  const signature = req.headers.get('x-zaptick-signature')!;
  const timestamp = req.headers.get('x-zaptick-timestamp')!;

  const ok = verifyWebhookSignature({
    payload, signature, timestamp,
    secret: process.env.ZAPTICK_WEBHOOK_SECRET!,
    tolerance: 300, // seconds, defaults to 5 min
  });

  if (!ok) return new Response('invalid signature', { status: 401 });
  // ... handle event
}