Real-Time Webhooks & Event Streams

Endpoint Configuration & Delivery Health

3 configured endpoints

Signature Header

X-Disha-Signature-256

Present on every delivery

Timestamp Header

X-Disha-Timestamp

Unix epoch (seconds)

Algorithm

HMAC-SHA256

Industry standard

Replay Protection

5-minute window

Reject stale timestamps

const crypto = require('crypto');

function verifyDISHASignature(
  secretKey,
  timestamp,
  rawBody,
  receivedSig
) {
  const payload = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac('sha256', secretKey)
    .update(payload, 'utf8')
    .digest('hex');
  
  const expectedSig = `sha256=${expected}`;
  
  // Constant-time comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expectedSig),
    Buffer.from(receivedSig)
  );
}

// Express.js middleware example
app.post('/webhooks/disha', express.raw({ type: '*/*' }), (req, res) => {
  const timestamp = req.headers['x-disha-timestamp'];
  const signature = req.headers['x-disha-signature-256'];
  
  if (!verifyDISHASignature(
    process.env.DISHA_WEBHOOK_SECRET,
    timestamp,
    req.body.toString(),
    signature
  )) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  const event = JSON.parse(req.body);
  console.log('Verified event:', event.eventType);
  res.json({ received: true });
});