Quickstart

1
// webhook-server.js
2
const express = require('express');
3
const crypto = require('crypto');
4
5
const app = express();
6
7
// Middleware to capture raw body for signature verification
8
app.use(express.json({
9
  verify: (req, res, buf) => {
10
    req.rawBody = buf.toString();
11
  }
12
}));
13
14
// Webhook endpoint
15
app.post('/webhooks/deel', (req, res) => {
16
  console.log('✅ Webhook received!');
17
  console.log('Event type:', req.body.data?.meta?.event_type);
18
19
  // Always respond with 200 immediately
20
  res.status(200).send('OK');
21
});
22
23
app.listen(3000, () => {
24
  console.log('🚀 Webhook server running on http://localhost:3000');
25
});

$
curl -X POST 'https://api.letsdeel.com/rest/v2/webhooks' \
>
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
>
  -H 'Content-Type: application/json' \
>
  -d '{
>
    "url": "https://abc123.ngrok.io/webhooks/deel",
>
    "events": ["contract.created", "contract.signed"],
>
    "description": "My first webhook"
>
  }'

1
// webhook-server.js
2
const express = require('express');
3
const crypto = require('crypto');
4
5
const app = express();
6
const SIGNING_KEY = process.env.DEEL_WEBHOOK_SECRET; // From Step 3
7
8
app.use(express.json({
9
  verify: (req, res, buf) => {
10
    req.rawBody = buf.toString();
11
  }
12
}));
13
14
function verifySignature(req) {
15
  const signature = req.headers['x-deel-signature'];
16
  const expectedSignature = crypto
17
    .createHmac('sha256', SIGNING_KEY)
18
    .update('POST' + req.rawBody)
19
    .digest('hex');
20
21
  return crypto.timingSafeEqual(
22
    Buffer.from(signature),
23
    Buffer.from(expectedSignature)
24
  );
25
}
26
27
app.post('/webhooks/deel', (req, res) => {
28
  // Verify signature
29
  if (!verifySignature(req)) {
30
    console.log('❌ Invalid signature!');
31
    return res.status(401).send('Invalid signature');
32
  }
33
34
  console.log('✅ Signature verified!');
35
  console.log('Event:', req.body.data.meta.event_type);
36
37
  res.status(200).send('OK');
38
});
39
40
app.listen(3000, () => {
41
  console.log('🚀 Secure webhook server running');
42
});