API Reference

Payload Example

POST https://your-server.com/webhook
Content-Type: application/json
X-Deploxa-Signature: sha256=abc123...
X-Deploxa-Event: deployment.ready

{
  "event": "deployment.ready",
  "deployment": {
    "id": "clm1abc...",
    "status": "READY",
    "branch": "main",
    "url": "https://my-app.deploxa.com"
  },
  "project": { "id": "...", "name": "my-app", "slug": "my-app" }
}

How it works

1. Deploxa computes HMAC-SHA256(rawBody, webhookSecret)
2. The hex digest is sent as X-Deploxa-Signature: sha256=<hex>
3. You compute the same HMAC and compare using a timing-safe comparison

Node.js

import { createHmac, timingSafeEqual } from "crypto";

function verifySignature(rawBody: string, secret: string, signature: string) {
  const expected = "sha256=" + createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(signature, "utf8");
  return a.length === b.length && timingSafeEqual(a, b);
}

// In your webhook handler:
app.post("/webhook", express.raw({ type: "*/*" }), (req, res) => {
  const sig = req.headers["x-deploxa-signature"] as string;
  if (!verifySignature(req.body.toString(), process.env.WEBHOOK_SECRET!, sig)) {
    return res.status(401).send("Invalid signature");
  }
  const payload = JSON.parse(req.body.toString());
  console.log("Event:", payload.event);
  res.sendStatus(200);
});

Python

import hmac
import hashlib

def verify_signature(raw_body: bytes, secret: str, signature: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# In your Flask/FastAPI handler:
@app.post("/webhook")
async def webhook(request: Request):
    raw = await request.body()
    sig = request.headers.get("x-deploxa-signature", "")
    if not verify_signature(raw, WEBHOOK_SECRET, sig):
        raise HTTPException(status_code=401, detail="Invalid signature")
    payload = json.loads(raw)
    print("Event:", payload["event"])
    return {"ok": True}

Go

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
)

func verifySignature(body []byte, secret, signature string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(body)
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(signature))
}