How do I verify webhook signature in Node.js?

Hey Carlos — yeah this one tripped me up too when I first looked at it. The signature is HMAC-SHA256 of the raw request body, not JSON.stringify(). FieldPulse signs the exact bytes as received, so you need to grab it before Express or whatever middleware parses it.

Here's what works:

const crypto = require('crypto');

function verifySignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody, 'utf8')
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(signature, 'hex')
  );
}

Important bits:

• Use rawBody — if you're using Express, you'll need something like express.raw({type: 'application/json'}) or a middleware that preserves the raw buffer
• Secret is your webhook signing secret from Settings → Integrations → Webhooks
• Always use timingSafeEqual — prevents timing attacks

Edge case: if the payload has unicode escapes, the raw body vs. re-serialized JSON will differ. That's usually where verification fails silently. Stick to raw bytes and you're good.

Docs reference: Setting Up Webhooks

Works. Had to disable express.json() for the webhook route and use express.raw() instead. Caught me that the signature includes the timestamp — thought it was just the data object.

Worth noting: header name is case-insensitive per HTTP spec, but FieldPulse always sends lowercase x-fieldpulse-signature. Some frameworks normalize to X-Fieldpulse-Signature.

Also documented in API Rate Limits and Best Practices — search "webhook verification".