Webhooks

1
const res = await fetch("https://api.slotflow.dev/v1/webhooks", {
2
  method: "POST",
3
  headers: {
4
    "Authorization": `Bearer ${process.env.SLOTFLOW_API_KEY}`,
5
    "Content-Type": "application/json",
6
  },
7
  body: JSON.stringify({
8
    url: "https://your-agent.com/webhooks/slotflow",
9
    events: ["booking.confirmed", "booking.cancelled"],
10
  }),
11
});
12
13
const webhook = await res.json();
14
// Save webhook.signing_secret securely — you'll need it to verify payloads
15
console.log(webhook.signing_secret); // "whsec_k8J2mN4p..."

1
const crypto = require("crypto");
2
3
function verifyWebhookSignature(rawBody, signatureHeader, signingSecret) {
4
  const [tPart, vPart] = signatureHeader.split(",");
5
  const timestamp = tPart.split("=")[1];
6
  const signature = vPart.split("=")[1];
7
8
  // Reject timestamps older than 5 minutes (replay protection)
9
  const age = Math.abs(Date.now() / 1000 - parseInt(timestamp));
10
  if (age > 300) {
11
    throw new Error("Webhook timestamp too old");
12
  }
13
14
  const expected = crypto
15
    .createHmac("sha256", signingSecret)
16
    .update(`${timestamp}.${rawBody}`)
17
    .digest("hex");
18
19
  const isValid = crypto.timingSafeEqual(
20
    Buffer.from(signature),
21
    Buffer.from(expected)
22
  );
23
24
  if (!isValid) {
25
    throw new Error("Invalid webhook signature");
26
  }
27
28
  return true;
29
}

1
const express = require("express");
2
const crypto = require("crypto");
3
const app = express();
4
5
// Use raw body for signature verification
6
app.post("/webhooks/slotflow", express.raw({ type: "application/json" }), (req, res) => {
7
  const signature = req.headers["x-slotflow-signature"];
8
  const rawBody = req.body.toString();
9
10
  // Verify the signature
11
  try {
12
    verifyWebhookSignature(rawBody, signature, process.env.SLOTFLOW_WEBHOOK_SECRET);
13
  } catch (err) {
14
    console.error("Webhook verification failed:", err.message);
15
    return res.sendStatus(401);
16
  }
17
18
  const { event, data } = JSON.parse(rawBody);
19
20
  switch (event) {
21
    case "booking.confirmed":
22
      console.log(`Booking confirmed: ${data.attendee_name} at ${data.starts_at}`);
23
      handleBookingConfirmed(data);
24
      break;
25
26
    case "booking.cancelled":
27
      console.log(`Booking cancelled: ${data.id}`);
28
      handleBookingCancelled(data);
29
      break;
30
  }
31
32
  // Always respond 200 quickly — do heavy processing asynchronously
33
  res.sendStatus(200);
34
});

1
// AI Sales Agent
2
metadata: {
3
  lead_id: "lead_8294",
4
  conversation_id: "conv_1847",
5
  source: "ai_sdr",
6
  qualified_at: "2026-03-10T13:45:00Z",
7
}
8
9
// Customer Support
10
metadata: {
11
  ticket_id: "ticket_12345",
12
  customer_id: "cust_6789",
13
  issue_type: "billing",
14
  priority: "high",
15
}
16
17
// Recruiting
18
metadata: {
19
  application_id: "app_456",
20
  job_id: "job_789",
21
  stage: "technical_interview",
22
}

1
app.post("/webhooks/slotflow", (req, res) => {
2
  const { event, data } = req.body;
3
4
  if (event === "booking.confirmed") {
5
    const { source } = data.metadata;
6
7
    if (source === "ai_sdr") {
8
      crm.updateLead(data.metadata.lead_id, { status: "demo_booked" });
9
    } else if (data.metadata.ticket_id) {
10
      supportSystem.updateTicket(data.metadata.ticket_id, { status: "callback_scheduled" });
11
    }
12
  }
13
14
  res.sendStatus(200);
15
});