### X-Twenty-Webhook-Timestamp

Unix timestamp of when the webhook was sent. This timestamp is included in the HMAC signature generation to prevent replay attacks.

### X-Twenty-Webhook-Timestamp

Unix timestamp of when the webhook was sent. This timestamp is included in the HMAC signature generation to prevent replay attacks.

const crypto = require("crypto");
const timestamp = "1735066639761";
const payload = JSON.stringify({...});
const secret = "your-secret";
const stringToSign = `${timestamp}:${JSON.stringify(payload)}`;
const signature = crypto.createHmac("sha256", secret)
  .update(stringToSign)
  .digest("hex");

const crypto = require("crypto");
const timestamp = "1735066639761";
const payload = JSON.stringify({...});
const secret = "your-secret";
const stringToSign = `${timestamp}:${JSON.stringify(payload)}`;
const signature = crypto.createHmac("sha256", secret)
  .update(stringToSign)
  .digest("hex");

## Headers
### X-Twenty-Webhook-Nonce

Unique identifier for this webhook request to prevent replay attacks. Consumers should ensure this nonce is not reused.

### X-Twenty-Webhook-Signature

HMAC SHA256 signature of the request payload using the webhook secret. To compute the signature:

Concatenate X-Twenty-Webhook-Timestamp, a colon (:), and the JSON string of the request payload.
Compute the HMAC SHA256 hash using the shared secret as the key.
Send the resulting hex digest as this header value.
Example (Node.js):

## Headers
### X-Twenty-Webhook-Nonce

Unique identifier for this webhook request to prevent replay attacks. Consumers should ensure this nonce is not reused.

### X-Twenty-Webhook-Signature

HMAC SHA256 signature of the request payload using the webhook secret. To compute the signature:

Concatenate X-Twenty-Webhook-Timestamp, a colon (:), and the JSON string of the request payload.
Compute the HMAC SHA256 hash using the shared secret as the key.
Send the resulting hex digest as this header value.
Example (Node.js):

  import crypto from 'crypto';

  private generateSignature(
    payload: CallWebhookJobData,
    secret: string,
    timestamp: string,
  ): string {
    return crypto
      .createHmac('sha256', secret)
      .update(`${timestamp}:${JSON.stringify(payload)}`)
      .digest('hex');
  }

  import crypto from 'crypto';

  private generateSignature(
    payload: CallWebhookJobData,
    secret: string,
    timestamp: string,
  ): string {
    return crypto
      .createHmac('sha256', secret)
      .update(`${timestamp}:${JSON.stringify(payload)}`)
      .digest('hex');
  }