Receive webhooks

curl -X POST https://api.urlcrop.com/v1/webhooks \
  -H "Authorization: Bearer $URLCROP_API_KEY" -H "Content-Type: application/json" \
  -d '{ "url": "https://crm.brand.in/hooks/urlcrop", "events": ["link.created", "link.safety_flagged", "domain.ssl_active", "usage.threshold_reached"] }'

{
  "id": "evt_01JB4P2Q7R8S9T0UVWXYZ012345",
  "object": "event",
  "type": "link.created",
  "api_version": "v1",
  "is_test": false,
  "created_at": "2026-12-05T10:15:30.000Z",
  "workspace_id": "ws_01JB4M0A1B2C3D4E5F6G7H8J9K",
  "data": { "object": { "id": "lnk_01JB4N8ZK3Q9WXYZ0123456789", "object": "link", "short_url": "https://go.brand.in/diwali" } }
}

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyURLCropSignature(rawBody: string, header: string, secret: string): boolean {
  const parts = header.split(',').map((p) => p.trim().split('='));
  const t = Number(parts.find(([k]) => k === 't')?.[1]);
  const sigs = parts.filter(([k]) => k === 'v1').map(([, v]) => v);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  return sigs.some((s) => s.length === expected.length && timingSafeEqual(Buffer.from(s, 'hex'), Buffer.from(expected, 'hex')));
}

// Express: app.post('/hooks/urlcrop', express.raw({ type: 'application/json' }), (req, res) => { … })
// or with the SDK: const event = uc.webhooks.constructEvent(rawBody, req.headers['urlcrop-signature'], secret);

<?php
function verifyUrlcropSignature(string $rawBody, string $header, string $secret): bool {
    $t = null; $sigs = [];
    foreach (explode(',', $header) as $pair) {
        [$k, $v] = array_map('trim', explode('=', $pair, 2));
        if ($k === 't') { $t = (int) $v; }
        if ($k === 'v1') { $sigs[] = $v; }
    }
    if ($t === null || abs(time() - $t) > 300 || !$sigs) { return false; }
    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    foreach ($sigs as $sig) { if (hash_equals($expected, $sig)) { return true; } }
    return false;
}

$raw = file_get_contents('php://input');
if (!verifyUrlcropSignature($raw, $_SERVER['HTTP_URLCROP_SIGNATURE'] ?? '', getenv('URLCROP_WEBHOOK_SECRET'))) {
    http_response_code(400); exit;
}
$event = json_decode($raw, true);