Know Which Ad Started Every WhatsApp Chat

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const app = express();
const SECRET = process.env.SM_WEBHOOK_SECRET; // the whole whsec_… string

function verify(rawBody, headers) {
  const ts = headers['x-sm-timestamp'];
  const sigs = headers['x-sm-signature'];
  if (!/^\d+$/.test(ts ?? '') || typeof sigs !== 'string') return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = createHmac('sha256', SECRET).update(`${ts}.`).update(rawBody).digest();
  return sigs.split(',').some((part) => {
    const m = /^v1=([0-9a-f]{64})$/.exec(part.trim());
    return m !== null && timingSafeEqual(Buffer.from(m[1], 'hex'), expected);
  });
}

app.post('/webhooks/startmessaging', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verify(req.body, req.headers)) return res.sendStatus(401);
  res.sendStatus(200); // answer within 5 seconds, then do the work

  const event = JSON.parse(req.body);
  if (event.type !== 'message.received') return;

  const { referral, from } = event.data.message;
  if (!referral) return; // not the first message from an ad

  // Any referral field can be null when Meta leaves it out.
  await saveAdLead({
    eventId: event.id, // delivered at least once: deduplicate on this
    phone: from,
    adId: referral.sourceId,
    headline: referral.headline,
    ctwaClid: referral.ctwaClid, // keep it for Meta's Conversions API
  });
  // When this lead converts, your own server sends ctwaClid to Meta's
  // Conversions API. StartMessaging does not send conversions to Meta.
});

import hmac, hashlib, json, os, time
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ['SM_WEBHOOK_SECRET'].encode()  # the whole whsec_… string

def verify(raw_body, ts, sigs):
    if not ts or not ts.isdigit() or not sigs:
        return False
    if abs(time.time() - int(ts)) > 300:
        return False
    expected = hmac.new(SECRET, f'{ts}.'.encode() + raw_body, hashlib.sha256).hexdigest()
    return any(
        hmac.compare_digest(part.strip()[3:], expected)
        for part in sigs.split(',') if part.strip().startswith('v1=')
    )

@app.post('/webhooks/startmessaging')
def startmessaging_webhook():
    raw = request.get_data()
    if not verify(raw, request.headers.get('X-SM-Timestamp'), request.headers.get('X-SM-Signature')):
        return '', 401
    event = json.loads(raw)
    if event['type'] == 'message.received':
        message = event['data']['message']
        referral = message.get('referral')
        if referral:  # first message from a Click-to-WhatsApp ad
            save_ad_lead(
                event_id=event['id'],  # deduplicate on this
                phone=message['from'],
                ad_id=referral.get('sourceId'),
                headline=referral.get('headline'),
                ctwa_clid=referral.get('ctwaClid'),  # for Meta's Conversions API
            )
    return '', 200