Webhooks

{
  "id": "evt_1f6c9e2a-3b4d-4e5f-8a7b-6c5d4e3f2a1b",
  "type": "booking.updated",
  "apiVersion": "v1",
  "createdAt": "2026-11-04T08:20:31.000Z",
  "hotelId": "hotel-alpenblick",
  "data": { "object": "booking", "id": "9d3c1b2a-7e6f-4a5b-8c9d-0e1f2a3b4c5d", "changes": ["status"] }
}

{
  "id": "evt_7a6b5c4d-3e2f-4a1b-9c8d-7e6f5a4b3c2d",
  "type": "availability.changed",
  "apiVersion": "v1",
  "createdAt": "2026-11-04T08:21:02.000Z",
  "hotelId": "hotel-alpenblick",
  "data": {
    "object": "availability",
    "roomTypeIds": ["0b7e2c1d-5f4a-4c3b-9e8d-7a6b5c4d3e2f"],
    "from": "2026-12-01",
    "to": "2026-12-04"
  }
}

POST /webhooks/stryk HTTP/1.1
Content-Type: application/json
User-Agent: STRYK-Webhooks/1.0
STRYK-Event-Id: evt_1f6c9e2a-3b4d-4e5f-8a7b-6c5d4e3f2a1b
STRYK-Event-Type: booking.updated
STRYK-Delivery-Id: 2b1a0f9e-8d7c-4b6a-a594-837261504f3e
STRYK-Delivery-Attempt: 1
STRYK-Signature: t=1793780431,v1=5f2c8a1e9b0d…

import crypto from 'node:crypto';
import express from 'express';

export function verifyStrykSignature(rawBody, header, secret, toleranceSeconds = 300) {
  if (!header) return false;
  let timestamp = null;
  const signatures = [];
  for (const part of header.split(',')) {
    const [key, value] = part.trim().split('=', 2);
    if (key === 't') timestamp = Number(value);
    if (key === 'v1' && value) signatures.push(value);
  }
  if (!Number.isInteger(timestamp) || signatures.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > toleranceSeconds) return false;

  const expected = crypto.createHmac('sha256', secret).update(`${timestamp}.`).update(rawBody).digest();
  // During a secret rotation the header carries two v1 values; one match is enough.
  return signatures.some((signature) => {
    const received = Buffer.from(signature, 'hex');
    return received.length === expected.length && crypto.timingSafeEqual(received, expected);
  });
}

const app = express();

// express.raw keeps the exact bytes. Parsing JSON first would break the signature.
app.post('/webhooks/stryk', express.raw({ type: 'application/json', limit: '1mb' }), (req, res) => {
  if (!verifyStrykSignature(req.body, req.get('STRYK-Signature'), process.env.STRYK_WEBHOOK_SECRET)) {
    return res.status(400).send('Invalid signature');
  }
  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(204);   // acknowledge within seconds …
  queue.add(event);      // … and process asynchronously, deduplicated by event.id
});

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request


def verify_stryk_signature(raw_body: bytes, header: str | None, secret: str, tolerance: int = 300) -> bool:
    if not header:
        return False
    timestamp, signatures = None, []
    for part in header.split(","):
        key, _, value = part.strip().partition("=")
        if key == "t":
            timestamp = value
        elif key == "v1" and value:
            signatures.append(value)
    if not timestamp or not timestamp.isdigit() or not signatures:
        return False
    if abs(int(time.time()) - int(timestamp)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    # During a secret rotation the header carries two v1 values; one match is enough.
    return any(hmac.compare_digest(expected, signature) for signature in signatures)


app = Flask(__name__)


@app.post("/webhooks/stryk")
def stryk_webhook():
    raw_body = request.get_data()  # exact bytes, before any JSON parsing
    if not verify_stryk_signature(raw_body, request.headers.get("STRYK-Signature"), os.environ["STRYK_WEBHOOK_SECRET"]):
        abort(400)
    event = json.loads(raw_body)
    enqueue(event)  # process asynchronously, deduplicated by event["id"]
    return "", 204