Post webhooks

curl -X POST "https://api.postpeer.dev/v1/notifications/" \
  -H "x-access-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "webhook",
    "eventTypes": [
      "post.scheduled",
      "post.published",
      "post.partial",
      "post.failed"
    ],
    "webhook": {
      "url": "https://example.com/webhooks/postpeer"
    }
  }'

Create post response: postId
Webhook payload:     data.post.id

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post(
	'/webhooks/postpeer',
	express.raw({ type: 'application/json' }),
	async (req, res) => {
		const secret = process.env.POSTPEER_WEBHOOK_SECRET;
		const timestamp = req.get('X-PostPeer-Timestamp');
		const receivedSignature = req.get('X-PostPeer-Signature');

		if (!secret || !timestamp || !receivedSignature) {
			return res.sendStatus(400);
		}

		const timestampNumber = Number(timestamp);
		const age = Math.abs(Math.floor(Date.now() / 1000) - timestampNumber);
		if (!Number.isFinite(timestampNumber) || age > 300) {
			return res.sendStatus(401);
		}

		const rawBody = req.body.toString('utf8');
		const digest = crypto
			.createHmac('sha256', secret)
			.update(`${timestamp}.${rawBody}`)
			.digest('hex');
		const expectedSignature = `sha256=${digest}`;

		const expected = Buffer.from(expectedSignature, 'utf8');
		const received = Buffer.from(receivedSignature, 'utf8');
		const valid =
			expected.length === received.length &&
			crypto.timingSafeEqual(expected, received);

		if (!valid) return res.sendStatus(401);

		const event = JSON.parse(rawBody);
		const postId = event.data.post.id;
		const status = event.data.post.status;

		// Replace this with your database update.
		// await db.posts.update({ where: { postpeerId: postId }, data: { status } });

		return res.sendStatus(200);
	},
);

import hashlib
import hmac
import json
import os
import time

from fastapi import FastAPI, Request, Response

app = FastAPI()


@app.post("/webhooks/postpeer")
async def handle_postpeer_webhook(request: Request):
    secret = os.environ.get("POSTPEER_WEBHOOK_SECRET")
    timestamp = request.headers.get("X-PostPeer-Timestamp")
    received_signature = request.headers.get("X-PostPeer-Signature")

    if not secret or not timestamp or not received_signature:
        return Response(status_code=400)

    try:
        timestamp_number = int(timestamp)
    except ValueError:
        return Response(status_code=401)

    if abs(int(time.time()) - timestamp_number) > 300:
        return Response(status_code=401)

    raw_body = await request.body()
    signed_payload = timestamp.encode("utf-8") + b"." + raw_body
    digest = hmac.new(
        secret.encode("utf-8"), signed_payload, hashlib.sha256
    ).hexdigest()
    expected_signature = f"sha256={digest}"

    if not hmac.compare_digest(expected_signature, received_signature):
        return Response(status_code=401)

    event = json.loads(raw_body)
    post_id = event["data"]["post"]["id"]
    status = event["data"]["post"]["status"]

    # Replace this with your database update.
    # await update_post_status(post_id, status)

    return Response(status_code=200)

{
	"version": "2026-06-01",
	"id": "evt_123",
	"type": "post.published",
	"createdAt": "2026-06-06T12:00:00.000Z",
	"projectId": "project_123",
	"profileId": null,
	"data": {
		"post": {
			"id": "post_123",
			"status": "published",
			"content": "Hello world",
			"scheduledFor": null,
			"publishedAt": "2026-06-06T12:00:00.000Z",
			"mediaItems": [],
			"links": {
				"postpeer": "https://postpeer.dev/dashboard/posts?post=post_123",
				"api": "https://api.postpeer.dev/v1/posts/post_123"
			}
		},
		"platforms": [
			{
				"platform": "twitter",
				"integrationId": "integration_123",
				"profileId": null,
				"status": "published",
				"platformPostId": "tweet_123",
				"platformPostUrl": "https://x.com/user/status/tweet_123",
				"publishedAt": "2026-06-06T12:00:00.000Z",
				"errorMessage": null,
				"warningMessage": null
			}
		]
	}
}