Webhooks

curl -X POST https://my.flowsign.app/api/v1/webhooks \
  -H "Authorization: Bearer fsk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://api.example.com/webhooks/flowsign",
    "events": ["PACKAGE_COMPLETED", "SESSION_DECLINED"],
    "description": "Production"
  }'

const res = await fetch("https://my.flowsign.app/api/v1/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.FLOWSIGN_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://api.example.com/webhooks/flowsign",
    events: ["PACKAGE_COMPLETED", "SESSION_DECLINED"],
    description: "Production",
  }),
});

const { data } = await res.json();
console.log(data.secret);

import os

import requests

res = requests.post(
    "https://my.flowsign.app/api/v1/webhooks",
    headers={"Authorization": f"Bearer {os.environ['FLOWSIGN_API_KEY']}"},
    json={
        "url": "https://api.example.com/webhooks/flowsign",
        "events": ["PACKAGE_COMPLETED", "SESSION_DECLINED"],
        "description": "Production",
    },
    timeout=30,
)
res.raise_for_status()

print(res.json()["data"]["secret"])

using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json;

using var http = new HttpClient { BaseAddress = new Uri("https://my.flowsign.app") };
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Bearer",
    Environment.GetEnvironmentVariable("FLOWSIGN_API_KEY"));

var res = await http.PostAsJsonAsync("/api/v1/webhooks", new
{
    url = "https://api.example.com/webhooks/flowsign",
    events = new[] { "PACKAGE_COMPLETED", "SESSION_DECLINED" },
    description = "Production",
});
res.EnsureSuccessStatusCode();

var body = await res.Content.ReadFromJsonAsync<JsonElement>();
Console.WriteLine(body.GetProperty("data").GetProperty("secret").GetString());

import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.FLOWSIGN_WEBHOOK_SECRET;

app.post(
  "/webhooks/flowsign",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const expected = createHmac("sha256", SECRET).update(req.body).digest("hex");
    const received = req.get("X-FlowSign-Signature") ?? "";

    const valid =
      expected.length === received.length &&
      timingSafeEqual(Buffer.from(expected), Buffer.from(received));

    if (!valid) return res.status(401).end();

    res.status(204).end();

    const payload = JSON.parse(req.body.toString("utf8"));
    handleEvent(req.get("X-FlowSign-Delivery-Id"), payload);
  },
);

import hmac
import os
from hashlib import sha256

from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["FLOWSIGN_WEBHOOK_SECRET"].encode()


@app.post("/webhooks/flowsign")
def flowsign_webhook():
    expected = hmac.new(SECRET, request.get_data(), sha256).hexdigest()
    received = request.headers.get("X-FlowSign-Signature", "")

    if not hmac.compare_digest(expected, received):
        return "", 401

    enqueue_event(request.headers["X-FlowSign-Delivery-Id"], request.get_json())
    return "", 204

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

var secret = Encoding.UTF8.GetBytes(builder.Configuration["FLOWSIGN_WEBHOOK_SECRET"]!);

app.MapPost("/webhooks/flowsign", async (HttpRequest req) =>
{
    using var buffer = new MemoryStream();
    await req.Body.CopyToAsync(buffer);
    var raw = buffer.ToArray();

    var expected = Convert.ToHexString(HMACSHA256.HashData(secret, raw)).ToLowerInvariant();
    var received = req.Headers["X-FlowSign-Signature"].ToString();

    var valid = CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expected),
        Encoding.UTF8.GetBytes(received));

    if (!valid) return Results.Unauthorized();

    var payload = JsonSerializer.Deserialize<JsonElement>(raw);
    EnqueueEvent(req.Headers["X-FlowSign-Delivery-Id"].ToString(), payload);

    return Results.NoContent();
});

app.Run();