Vyora API

// Express.js — verify signature before processing
const crypto = require('crypto');

function verifySignature(rawBody, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  // Use timingSafeEqual to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig    = req.headers['x-vyora-signature'];
  const secret = process.env.VYORA_WEBHOOK_SECRET;

  if (!sig || !verifySignature(req.body, sig, secret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const body  = JSON.parse(req.body);
  const event = req.headers['x-vyora-event'];

  if (event === 'call_completed') {
    console.log(`Call ${body.call_id} ended — status: ${body.status}`);
  }

  if (event === 'all_processing_completed') {
    console.log('Analysis ready:', body.analysis?.summary);
  }

  res.status(200).json({ received: true });
});

import hmac, hashlib, os

def verify_signature(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# Flask example
@app.route('/webhook', methods=['POST'])
def webhook():
    sig    = request.headers.get('X-Vyora-Signature', '')
    secret = os.environ['VYORA_WEBHOOK_SECRET']

    if not verify_signature(request.data, sig, secret):
        return {'error': 'Invalid signature'}, 401

    body  = request.get_json()
    event = request.headers.get('X-Vyora-Event')

    if event == 'call_completed':
        print(f"Call {body['call_id']} ended — {body['status']}")

    return {'received': True}, 200