Server API and webhooks

curl "https://talkieback.com/api/server/v1/feedbacks?status=new&limit=20" \
  -H "Authorization: Bearer sk_live_…"

{
  "id": "evt_8Kq2mXz4Tb7Rn3Wc9P",
  "type": "feedback.rewarded",
  "created_at": "2026-10-29T15:10:42.000Z",
  "data": {
    "feedback": { "id": "3f6d2a9e-8c1b-4f5e-9a7d-2b4c6e8f1a3d", "status": "done", "user": { "external_id": "42", "verified": true }, … },
    "reward": "5 boosters"
  }
}

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const app = express();

// the raw body: the signature covers the bytes received, not the parsed JSON
app.post('/webhooks/talkieback', express.raw({ type: 'application/json' }), (req, res) => {
  const parts = Object.fromEntries(
    (req.get('Talkieback-Signature') ?? '').split(',').map((p) => p.split('=')),
  );
  const expected = createHmac('sha256', process.env.TALKIEBACK_WEBHOOK_SECRET)
    .update(`${parts.t}.${req.body}`)
    .digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  const valid =
    typeof parts.v1 === 'string' &&
    parts.v1.length === expected.length &&
    timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
  if (!fresh || !valid) return res.status(400).send('Invalid signature');

  const event = JSON.parse(req.body);
  // event.id is unique: ignore an event you already handled
  if (event.type === 'feedback.rewarded') {
    // the reward to credit: event.data.reward
  }
  res.sendStatus(200);
});

app.listen(3000);

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)


@app.post("/webhooks/talkieback")
def talkieback_webhook():
    header = request.headers.get("Talkieback-Signature", "")
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    body = request.get_data()
    expected = hmac.new(
        os.environ["TALKIEBACK_WEBHOOK_SECRET"].encode(),
        parts.get("t", "").encode() + b"." + body,
        hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(expected, parts.get("v1", "")):
        abort(400)
    if abs(time.time() - int(parts["t"])) > 300:
        abort(400)
    event = request.get_json()
    # event["id"] is unique: ignore an event you already handled
    return "", 200

<?php
$secret = getenv('TALKIEBACK_WEBHOOK_SECRET');
$body = file_get_contents('php://input');

$parts = [];
foreach (explode(',', $_SERVER['HTTP_TALKIEBACK_SIGNATURE'] ?? '') as $part) {
    [$key, $value] = array_pad(explode('=', $part, 2), 2, '');
    $parts[$key] = $value;
}

$expected = hash_hmac('sha256', ($parts['t'] ?? '') . '.' . $body, $secret);
$fresh = abs(time() - (int) ($parts['t'] ?? 0)) < 300;
if (!$fresh || !hash_equals($expected, $parts['v1'] ?? '')) {
    http_response_code(400);
    exit;
}

$event = json_decode($body, true);
// $event['id'] is unique: ignore an event you already handled
http_response_code(200);

import { createHmac } from 'node:crypto';

const hash = createHmac('sha256', process.env.TALKIEBACK_SECRET)
  .update(String(user.id))
  .digest('hex');

import hashlib
import hmac
import os

user_hash = hmac.new(
    os.environ["TALKIEBACK_SECRET"].encode(),
    str(user.id).encode(),
    hashlib.sha256,
).hexdigest()

<?php
$hash = hash_hmac('sha256', (string) $user->id, getenv('TALKIEBACK_SECRET'));

// supabase functions deploy talkieback-hash
// supabase secrets set TALKIEBACK_SECRET=sk_live_…
import { createClient } from 'npm:@supabase/supabase-js@2';

const encoder = new TextEncoder();

async function hmacHex(secret: string, value: string): Promise<string> {
  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(value));
  return Array.from(new Uint8Array(signature), (b) => b.toString(16).padStart(2, '0')).join('');
}

const cors = {
  'Access-Control-Allow-Origin': '*',
  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
};

Deno.serve(async (req) => {
  if (req.method === 'OPTIONS') return new Response('ok', { headers: cors });
  // the signed-in user, from their Supabase token: never an id sent by the browser
  const supabase = createClient(Deno.env.get('SUPABASE_URL')!, Deno.env.get('SUPABASE_ANON_KEY')!, {
    global: { headers: { Authorization: req.headers.get('Authorization') ?? '' } },
  });
  const { data: { user } } = await supabase.auth.getUser();
  if (!user) return new Response('Unauthorized', { status: 401, headers: cors });
  const hash = await hmacHex(Deno.env.get('TALKIEBACK_SECRET')!, user.id);
  return Response.json({ id: user.id, hash }, { headers: cors });
});

<script>
  window.talkieback = window.talkieback || [];
  talkieback.push(['identify', { id: '42', email: 'camille@example.com', name: 'Camille' }, '<hash computed by your server>']);
</script>

<script>
  window.talkieback = window.talkieback || [];
  talkieback.push(['lang', 'de']);
</script>

importScripts('https://cdn.talkieback.com/sw.js');