Example PHP script

// Commusoft Webhook Verification Example (PHP)
// This script demonstrates how to verify that a request is authentic
// and originated from Commusoft using the HMAC-SHA256 signature.

// Your unique signing secret can be retried inside Private application or via API
// In a production environment, store this in an environment variable.
$signing_secret = 'whsec_7d2f9a1b8c3e4f5g6h7i8j9k0l';

// Retrieve the signature header
$header = $_SERVER['HTTP_X_COMMUSOFT_SIGNATURE'] ?? '';

if (empty($header)) {
    http_response_code(401);
    exit('Missing signature header.');
}

// The header format is "t=timestamp,v1=signature"
// We need to split these to get the individual values.
$parts = explode(',', $header);
$timestamp_part = str_replace('t=', '', $parts[0]);
$signature_part = str_replace('v1=', '', $parts[1]);

// Get the raw request body
// Note: We MUST use the raw body, not $_POST, to ensure the hash matches.
$raw_payload = file_get_contents('php://input');

// Verify the signature
// We create a "base string" by concatenating the timestamp, a dot, and the payload.
// Then we hash it using the SHA256 algorithm and our secret key.

$base_string = $timestamp_part . '.' . $raw_payload;
$expected_signature = hash_hmac('sha256', $base_string, $signing_secret);

// Use hash_equals to prevent timing attacks
if (!hash_equals($expected_signature, $signature_part)) {
    http_response_code(403);
    exit('Invalid signature. Request rejected.');
}

// Optional: Replay Attack Protection
// Ensure the request is recent (e.g., within the last 5 minutes)

$tolerance = 300; // 5 minutes in seconds
if (abs(time() - (int)$timestamp_part) > $tolerance) {
    http_response_code(403);
    exit('Request timestamp is outside of the allowed tolerance window.');
}

// Success! Process the data.
$data = json_decode($raw_payload, true);

// Example: Log the Job ID that was updated
$job_id = $data['id'];
$event_type = $data['eventType'];

error_log("Successfully verified $event_type for Job ID: $job_id");

// Always return a 2xx status code back to Commusoft immediately
http_response_code(200);
echo "Webhook processed successfully.";
`