Webhook Integration Guide

import express from 'express';
import * as jose from 'jose';

const app = express();

// IMPORTANT: Use raw body for JWT
app.post('/webhooks/engageplus',
  express.text({ type: 'application/secevent+jwt' }),
  async (req, res) => {
    try {
      const jwt = req.body;
      
      // Create JWKS client
      const JWKS = jose.createRemoteJWKSet(
        new URL('https://engageplus.id/.well-known/jwks.json')
      );
      
      // Verify JWT signature
      const { payload } = await jose.jwtVerify(jwt, JWKS, {
        issuer: 'https://engageplus.id',
      });
      
      // Get event data
      const eventType = req.headers['x-engageplus-event'];
      const event = payload.events['https://engageplus.id/events/auth_success'];
      
      console.log('User authenticated:', {
        userId: payload.sub,
        organizationId: event.organizationId,
        provider: event.provider.type,
      });
      
      // Your business logic here
      await handleUserAuthentication(payload.sub, event);
      
      // Respond with 200
      res.status(200).send('OK');
    } catch (error) {
      console.error('Webhook verification failed:', error);
      res.status(401).send('Unauthorized');
    }
  }
);

app.listen(3000);

from flask import Flask, request
import jwt
import requests

app = Flask(__name__)

@app.route('/webhooks/engageplus', methods=['POST'])
def webhook():
    try:
        token = request.get_data(as_text=True)
        
        # Fetch JWKS
        jwks_url = 'https://engageplus.id/.well-known/jwks.json'
        jwks_client = jwt.PyJWKClient(jwks_url)
        
        # Get signing key
        signing_key = jwks_client.get_signing_key_from_jwt(token)
        
        # Verify and decode JWT
        payload = jwt.decode(
            token,
            signing_key.key,
            algorithms=["RS256"],
            issuer='https://engageplus.id'
        )
        
        # Extract event data
        event = payload['events']['https://engageplus.id/events/auth_success']
        user_id = payload['sub']
        
        print(f"User {user_id} authenticated via {event['provider']['type']}")
        
        # Your business logic
        handle_user_authentication(user_id, event)
        
        return 'OK', 200
        
    except Exception as e:
        print(f'Webhook verification failed: {e}')
        return 'Unauthorized', 401

if __name__ == '__main__':
    app.run(port=3000)

<?php
require 'vendor/autoload.php';

use Firebase\JWT\JWT;
use Firebase\JWT\JWK;

// Get raw POST body
$jwt = file_get_contents('php://input');

try {
    // Fetch JWKS
    $jwks_url = 'https://engageplus.id/.well-known/jwks.json';
    $jwks_json = file_get_contents($jwks_url);
    $jwks = json_decode($jwks_json, true);
    
    // Decode and verify JWT
    $decoded = JWT::decode($jwt, JWK::parseKeySet($jwks));
    
    // Extract event data
    $event = $decoded->events->{'https://engageplus.id/events/auth_success'};
    $user_id = $decoded->sub;
    
    error_log("User $user_id authenticated via " . $event->provider->type);
    
    // Your business logic
    handleUserAuthentication($user_id, $event);
    
    http_response_code(200);
    echo 'OK';
    
} catch (Exception $e) {
    error_log('Webhook verification failed: ' . $e->getMessage());
    http_response_code(401);
    echo 'Unauthorized';
}
?>