Webhook receiver reference

{
  "id": "whev_01J...",
  "type": "run.status_changed",
  "apiVersion": "2026-07-01",
  "createdAt": "2026-07-13T12:00:00.000Z",
  "test": false,
  "data": {
    "run": {
      "id": "exec_01J...",
      "automationId": "aut_01J...",
      "type": "workflow",
      "status": "completed",
      "triggerType": "api",
      "createdAt": "2026-07-13T11:59:30.000Z",
      "startedAt": "2026-07-13T11:59:31.000Z",
      "completedAt": "2026-07-13T12:00:00.000Z",
      "output": {
        "invoiceNumber": "INV-1042"
      }
    },
    "previousStatus": "running",
    "currentStatus": "completed"
  }
}

<webhook-id>.<webhook-timestamp>.<raw request body>

import { createHmac, timingSafeEqual } from 'node:crypto';

function verifyEigenpalWebhook(rawBody: Buffer, headers: Headers, secret: string): boolean {
  const eventId = headers.get('webhook-id');
  const timestamp = headers.get('webhook-timestamp');
  const signature = headers.get('webhook-signature');
  if (!eventId || !timestamp || !signature?.startsWith('v1,')) return false;

  const ageSeconds = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(ageSeconds) || ageSeconds > 300) return false;

  const expected = createHmac('sha256', secret)
    .update(`${eventId}.${timestamp}.`)
    .update(rawBody)
    .digest('hex');
  const received = signature.slice(3);

  if (!/^[a-f0-9]+$/i.test(received)) return false;
  const expectedBytes = Buffer.from(expected, 'hex');
  const receivedBytes = Buffer.from(received, 'hex');
  if (expectedBytes.length !== receivedBytes.length) return false;
  return timingSafeEqual(expectedBytes, receivedBytes);
}