How to receive Coolie webhooks in Node.js and verify their signature

curl https://trycoolie.ai/api/v1/webhooks \
  -H "Authorization: Bearer $COOLIE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://your-server.example/coolie", "events": ["lead.created", "lead.replied"] }'

{
  "webhook": {
    "id": "whk_Hq2xV7pLm0aZ9RkT",
    "url": "https://your-server.example/coolie",
    "events": [
      "lead.created",
      "lead.replied"
    ],
    "enabled": true,
    "createdAt": "2026-10-19T09:30:00.000Z",
    "secret": "whsec_…",
    "last": null
  }
}

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.COOLIE_WEBHOOK_SECRET; // whsec_…, from Settings → Webhooks
const handled = new Set(); // event ids already handled: keep them in your database in production

// Coolie-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body" with your secret>
function fromCoolie(rawBody, header, secret) {
  const parts = Object.fromEntries(String(header ?? "").split(",").map((part) => part.split("=")));
  const expected = Buffer.from(crypto.createHmac("sha256", secret).update(parts.t + "." + rawBody).digest("hex"));
  const given = Buffer.from(String(parts.v1 ?? ""));
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

const app = express();

// express.raw keeps the body as Coolie sent it: the signature is computed on those bytes.
app.post("/coolie", express.raw({ type: "application/json" }), (req, res) => {
  const rawBody = req.body.toString("utf8");
  if (!fromCoolie(rawBody, req.get("Coolie-Signature"), SECRET)) return res.sendStatus(401);
  res.sendStatus(200); // answer first: Coolie waits ten seconds at most

  const event = JSON.parse(rawBody);
  if (handled.has(event.id)) return; // a retry of an event already handled
  handled.add(event.id);

  if (event.type === "lead.created") {
    const { company, contact, signal } = event.data.lead;
    console.log(signal.name + " at " + company.name + ": " + (contact?.name ?? "no contact yet"));
  }
});

app.listen(3000);

// app/api/coolie/route.ts
import crypto from "node:crypto";

export async function POST(request: Request) {
  const rawBody = await request.text();
  const parts = Object.fromEntries(
    (request.headers.get("coolie-signature") ?? "").split(",").map((part) => part.split("=")),
  );
  const expected = Buffer.from(
    crypto.createHmac("sha256", process.env.COOLIE_WEBHOOK_SECRET!).update(parts.t + "." + rawBody).digest("hex"),
  );
  const given = Buffer.from(String(parts.v1 ?? ""));
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  if (!fresh || given.length !== expected.length || !crypto.timingSafeEqual(given, expected)) {
    return new Response("Bad signature", { status: 401 });
  }
  const event = JSON.parse(rawBody);
  // Queue the work on event.type and event.data, and answer at once.
  console.log(event.type, event.id);
  return new Response(null, { status: 204 });
}

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["COOLIE_WEBHOOK_SECRET"]  # whsec_…, from Settings → Webhooks


def from_coolie(raw_body: bytes, header: str, secret: str) -> bool:
    """Coolie-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body" with your secret>"""
    parts = dict(part.split("=", 1) for part in header.split(",") if "=" in part)
    timestamp, given = parts.get("t", ""), parts.get("v1", "")
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, given)


@app.post("/coolie")
def coolie_webhook():
    raw_body = request.get_data()  # the bytes as Coolie sent them
    if not from_coolie(raw_body, request.headers.get("Coolie-Signature", ""), SECRET):
        abort(401)
    event = json.loads(raw_body)
    if event["type"] == "lead.created":
        lead = event["data"]["lead"]
        print(lead["signal"]["name"], "at", lead["company"]["name"])
    return "", 200

curl -X POST https://trycoolie.ai/api/v1/webhooks/whk_Hq2xV7pLm0aZ9RkT/test \
  -H "Authorization: Bearer $COOLIE_API_KEY"

{
  "delivered": true,
  "httpStatus": 200,
  "error": null
}

POST /coolie HTTP/1.1
Host: your-server.example
Content-Type: application/json
User-Agent: Coolie-Webhooks/1.0 (+https://trycoolie.ai)
Coolie-Event: lead.created
Coolie-Event-Id: evt_Tq4mZ8cW2xLp7VbN
Coolie-Signature: t=1792141334,v1=6f1c0e…

{
  "id": "evt_Tq4mZ8cW2xLp7VbN",
  "type": "lead.created",
  "createdAt": "2026-10-19T09:02:14.020Z",
  "data": {
    "lead": {
      "runId": "ui-5b9e2c41",
      "prospectId": "p-41b7c2d9e0aa",
      "agentId": "agent-3f2a91c0",
      "status": "enriched",
      "processedAt": "2026-10-19T09:02:13.511Z",
      "icpMatch": true,
      "aiScore": 8.4,
      "feedback": null,
      "signal": {
        "type": "hiring",
        "name": "Hiring",
        "headline": "Operations Manager",
        "detail": null,
        "url": "https://jobs.example.com/12345",
        "postedAt": "2026-10-17"
      },
      "company": {
        "name": "Northwind Health",
        "domain": "northwind.example",
        "website": "https://northwind.example",
        "linkedinUrl": "https://www.linkedin.com/company/example",
        "industry": "Hospitals and Health Care",
        "employees": 320,
        "country": "France",
        "locations": [
          "Lyon, France"
        ]
      },
      "contact": {
        "name": "Camille Martin",
        "title": "COO",
        "seniority": "c_suite",
        "linkedinUrl": "https://www.linkedin.com/in/example",
        "country": "France",
        "email": "camille.martin@northwind.example",
        "emailConfidence": 0.92,
        "phone": null
      },
      "research": null,
      "sequence": null
    }
  }
}