Webhooks

{
  "event": "job.completed",
  "job": {
    "id": "665f1d00b8d4e91a2c3d4e60",
    "type": "audio",
    "status": "completed",
    "result": {
      "outputKey": "outputs/665f1d00b8d4e91a2c3d4e60/result.ogg",
      "metrics": { "inputSize": 52428800, "outputSize": 6291456, "compressionRatio": 8.33 }
    },
    "error": null,
    "createdAt": "2026-07-11T14:02:11.000Z",
    "completedAt": "2026-07-11T14:03:40.000Z"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyRobinWebhook(rawBody: string, headers: Record<string, string>, secret: string): boolean {
  const timestamp = headers["x-robin-timestamp"];
  const received = headers["x-robin-signature"]; // "sha256=<hex>"

  const expected = "sha256=" + createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(received ?? "");
  if (a.length !== b.length) return false;
  if (!timingSafeEqual(a, b)) return false;

  // Reject stale deliveries (replay protection)
  return Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;
}