Webhooks

Subscribe to event notifications and poll for sample data.

Webhook verification HiringCenter Pro signs outbound webhook requests using a per-endpoint secret and includes a signature header X-HiringCenter-Pro-Signature.

Header format: t=<unix_timestamp>,v1=<hex_hmac>

To verify the signature:

1. Read the exact raw request body string (not the parsed JSON).
2. Build the signed payload as ${t}.${rawBody} where t is the timestamp from the header.
3. Compute expected = HMAC_SHA256(endpointSecret, signedPayload) and hex-encode it.
4. Compare expected to the v1 value from the header using a constant-time comparison.
5. Enforce a timestamp tolerance window (for example, 300 seconds) to mitigate replay attacks.

Node.js example:

Code
 
const crypto = require('crypto');
function verifyHiringCenterSignature({ rawBody, signatureHeader, endpointSecret, toleranceSeconds = 300 }) {
  if (!signatureHeader) return false;
  const m = signatureHeader.match(/t=(\d+),v1=([0-9a-fA-F]+)/);
  if (!m) return false;
  const ts = parseInt(m[1], 10);
  const v1 = m[2];
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - ts) > toleranceSeconds) return false;
  const expected = crypto.createHmac('sha256', endpointSecret)
    .update(`${ts}.${rawBody}`)
    .digest('hex');
  try {
    return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(v1, 'hex'));
  } catch {
    return false;
  }
}