Webhooks

Settings

You can enable Webhooks on TalkPlus Dashboard as follows:

Enable Webhook feature
Enter webhook handler endpoint
Select events that will trigger webhook

Endpoint

Endpoint must be able to handle HTTP POST request
Endpoint must be able to handle JSON format

If endpoint fails to respond, TalkPlus will re-attempt once after 5 seconds..

Header

TalkPlus HTTP POST webhook will contain the following headers:

User-Agent

TalkPlus

content-type

application/json

x-talkplus-signature

payload is signed with your app API key using SHA-256 and then encoded to Base64

Verification

To Verify that the request to your endpoint came from TalkPlus server, compare x-talkplus-signature header value against the hash of response body.

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"io"
	"net/http"
)

const apiKey = "<your-api-key>"

func main() {
	http.HandleFunc("/webhook", func(w http.ResponseWriter, r *http.Request) {
		signatureFromHeader := r.Header.Get("X-TalkPlus-Signature")

		responseBody, err := io.ReadAll(r.Body)
		if err != nil {
			http.Error(w, "failed to read body", http.StatusBadRequest)
			return
		}

		hash := hmac.New(sha256.New, []byte(apiKey))
		hash.Write(responseBody)
		computedSignature := base64.StdEncoding.EncodeToString(hash.Sum(nil))

		fmt.Printf("signatures match: %v\n", signatureFromHeader == computedSignature)

		w.WriteHeader(http.StatusOK)
		w.Write([]byte("OK"))
	})

	http.ListenAndServe(":8080", nil)
}

const express = require("express");
const crypto = require("crypto");
const app = express();
const apiKey = '<your-api-key>';

app.use((req, res, next) => {
  let data = '';
  req.setEncoding('utf8');
  req.on('data', chunk => { data += chunk });
  req.on('end', () => {
    req.rawBody = data;
    next();
  });
});

app.post("/webhook", async (req, res) => {
  const signatureFromHeader = req.headers['x-talkplus-signature'];
  const computedSignature = crypto.createHmac('sha256', apiKey).update(req.rawBody).digest('base64');
  console.log('signatures match: ', signatureFromHeader == computedSignature);

  res.send("OK");
});

app.listen(8080);

from flask import Flask, request
import hmac
import hashlib
import base64

app = Flask(__name__)
api_key = "<your-api-key>"

@app.route("/webhook", methods=["POST"])
def webhook():
    signature_from_header = request.headers.get("X-TalkPlus-Signature")
    raw_payload = request.get_data()

    # for python versions before v3.5.10
    # digest = hmac.new(
    #     api_key,
    #     msg=raw_payload,
    #     digestmod=hashlib.sha256
    # ).digest()

    # for python v3.5.10+,
    # hmac.new function requires key to be bytes or bytearray object
    digest = hmac.new(
        api_key.encode('ascii'),
        msg=raw_payload,
        digestmod=hashlib.sha256
    ).digest()
    computed_signature = base64.b64encode(digest).decode()
    print('signatures match: ', computed_signature == signature_from_header)
    
    return "OK", 200

if __name__ == "__main__":
    app.run(port=8080)

package com.example.java;

import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

@RestController
public class WebhookController extends HttpServlet {

    private final String apiKey = "<your-api-key>";

    @PostMapping("/webhook")
    public String handleWebhook(HttpServletRequest request, HttpServletResponse response) throws IOException {
        String signatureFromHeader = request.getHeader("X-TalkPlus-Signature");
        byte[] body = request.getInputStream().readAllBytes();

        try {
            Mac hmacSha256 = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKey = new SecretKeySpec(apiKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
            hmacSha256.init(secretKey);

            byte[] hash = hmacSha256.doFinal(body);
            String computedSignature = Base64.getEncoder().encodeToString(hash);

            System.out.printf("signatures match: %b\n", signatureFromHeader.equals(computedSignature));
        } catch (Exception e) {
            e.printStackTrace();
        }

        return "OK";
    }
}

Webhook Events

Event

Trigger

message

message sent

message_deleted

message deleted

reaction_added

reaction added to a message

reaction_deleted

reaction deleted from a message

channel_added

channel created

channel_changed

channel updated

channel_removed

channel deleted

member_added

member joined channel

member_left

member left channel

member_muted

member muted in channel

member_unmuted

member unmuted in channel

member_banned

user banned from channel

member_unbanned

user unbanned from channel

user_blocked

user blocked

user_unblocked

user unblocked

Webhook Event Payloads