Anything the editor does, the API does.

import { unwrapWebhook } from "@nohead/sdk/webhooks"
import { revalidateTag } from "next/cache"

export async function POST(request: Request) {
  // Checks the signature and the timestamp, or throws
  const event = await unwrapWebhook(
    await request.text(), // the raw body, as signed
    request.headers,
    { secret: process.env.NOHEAD_WEBHOOK_SECRET! }
  )

  // Skip the changes this integration made itself
  if (event.actor.id === process.env.NOHEAD_KEY_ID) {
    return new Response(null, { status: 204 })
  }

  if (event.type === "record.published" && event.data.record) {
    revalidateTag(event.data.record.collection, "max")
  }
  return new Response(null, { status: 204 })
}

import os
from flask import Flask, request
from nohead.webhooks import unwrap

app = Flask(__name__)

@app.post("/nohead")
def nohead_webhook():
    # Checks the signature and the timestamp, or raises
    event = unwrap(
        request.get_data(),  # the raw body, as signed
        request.headers,
        secret=os.environ["NOHEAD_WEBHOOK_SECRET"],
    )

    # Skip the changes this integration made itself
    if event.actor.id == os.environ["NOHEAD_KEY_ID"]:
        return "", 204

    if event.type == "record.published" and event.record:
        rebuild(event.record.collection)
    return "", 204

class WebhooksController < ApplicationController
  skip_forgery_protection

  def create
    # Checks the signature and the timestamp, or raises
    event = Nohead::Webhooks.unwrap(
      request.raw_post, # the raw body, as signed
      request.headers,
      secret: ENV.fetch("NOHEAD_WEBHOOK_SECRET")
    )

    # Skip the changes this integration made itself
    return head :no_content if event.actor.id == ENV.fetch("NOHEAD_KEY_ID")

    if event.type == "record.published" && event.data.record
      RebuildJob.perform_later(event.data.record.collection)
    end
    head :no_content
  end
end

import { createHmac, timingSafeEqual } from "node:crypto"

function verify(secret, headers, rawBody) {
  const id = headers["webhook-id"]
  const timestamp = headers["webhook-timestamp"]

  // Refuse a missing timestamp, or one more than five minutes off
  const age = Math.abs(Date.now() / 1000 - Number(timestamp))
  if (!Number.isFinite(age) || age > 300) return false

  // HMAC-SHA256 of id.timestamp.body, keyed with the secret after whsec_
  const key = Buffer.from(secret.slice("whsec_".length), "base64")
  const signed = `${id}.${timestamp}.${rawBody}`
  const expected =
    "v1," + createHmac("sha256", key).update(signed).digest("base64")

  // Any one of the space-separated signatures may match
  return headers["webhook-signature"].split(" ").some(
    (signature) =>
      signature.length === expected.length &&
      timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  )
}