Sahha x Supabase Integration

Use the Sahha Demo App (fastest way to test)

1. In the Sahha dashboard, go to Configure → Demo App
2. Copy the Configuration URL (or scan the QR code)
3. Install the Sahha Demo App from the App Store / Google Play
4. In the demo app, paste the Configuration URL (or scan the QR) to connect it to your project
5. Keep the demo app running so it can collect and submit device data

Once connected, you should see a new profile appear in your Sahha project and data beginning to flow.

If you’ve already integrated the Sahha SDK into your application, ensure that:

• Your app is successfully streaming data to Sahha
• You are setting a stable externalId when creating Sahha profiles (for example, your Supabase Auth UID)

This externalId will later be sent back in webhooks as X-External-Id, which allows you to map Sahha events to the correct user in your database.

Download the starter project — it includes an Edge Function with signature verification, Postgres migrations, and all project configuration already set up.

After downloading:

1. Unzip and open the project
2. Link it to your Supabase project using your Project ID (found in Supabase Dashboard → Project Settings → General):

cd sahha-supabase-webhooks-starter
npx supabase link --project-ref your-project-id

3. Apply the database migration to create the sahha_events table:

npx supabase db push

When prompted, confirm with Y to apply the migration. You can verify the table was created in the Supabase Dashboard → Table Editor → sahha_events.

From an empty directory, initialize a new Supabase project:

npx supabase init

Link it to your Supabase project using your Project ID (found in Supabase Dashboard → Project Settings → General):

npx supabase link --project-ref your-project-id

Create a new Edge Function:

npx supabase functions new sahha-webhook

Replace the contents of supabase/functions/sahha-webhook/index.ts with:

import { createClient } from "https://esm.sh/@supabase/supabase-js@2";

const SECRET = Deno.env.get("SAHHA_WEBHOOK_SECRET") ?? "";
const SUPABASE_URL = Deno.env.get("SUPABASE_URL") ?? "";
const SUPABASE_SERVICE_ROLE_KEY =
  Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "";

const encoder = new TextEncoder();

async function hmacSha256(
  secret: string,
  data: Uint8Array,
): Promise<string> {
  const key = await crypto.subtle.importKey(
    "raw",
    encoder.encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"],
  );
  const sig = await crypto.subtle.sign("HMAC", key, data);
  return [...new Uint8Array(sig)]
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

async function sha256Hex(data: Uint8Array): Promise<string> {
  const hash = await crypto.subtle.digest("SHA-256", data);
  return [...new Uint8Array(hash)]
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

Deno.serve(async (req) => {
  try {
    const signature = (req.headers.get("x-signature") ?? "").trim();
    const eventType = (req.headers.get("x-event-type") ?? "").trim();
    const externalId = (req.headers.get("x-external-id") ?? "").trim();

    if (!signature) {
      return new Response("Missing X-Signature", { status: 400 });
    }

    const rawBody = new Uint8Array(await req.arrayBuffer());

    if (!SECRET) {
      return new Response("Missing SAHHA_WEBHOOK_SECRET", { status: 500 });
    }

    const computed = await hmacSha256(SECRET, rawBody);
    if (computed !== signature) {
      return new Response("Invalid signature", { status: 401 });
    }

    const payload = JSON.parse(new TextDecoder().decode(rawBody));
    const eventHash = await sha256Hex(rawBody);

    const supabase = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);

    const { error } = await supabase.from("sahha_events").upsert(
      {
        event_type: eventType || "unknown",
        external_id: externalId,
        payload,
        event_hash: eventHash,
      },
      { onConflict: "event_hash" },
    );

    if (error) {
      console.error("Insert error:", error);
      return new Response("Database error", { status: 500 });
    }

    return new Response("ok", { status: 200 });
  } catch (err) {
    console.error(err);
    return new Response("Server error", { status: 500 });
  }
});

Create a migration file at supabase/migrations/001_create_sahha_events.sql:

create table if not exists sahha_events (
  id bigint generated always as identity primary key,
  event_type text not null,
  external_id text not null default '',
  payload jsonb not null default '{}',
  event_hash text not null,
  created_at timestamptz not null default now(),
  constraint sahha_events_event_hash_unique unique (event_hash)
);

create index if not exists idx_sahha_events_event_type
  on sahha_events (event_type);
create index if not exists idx_sahha_events_external_id
  on sahha_events (external_id);

Apply the migration:

npx supabase db push

When prompted, confirm with Y to apply the migration. You can verify the table was created in the Supabase Dashboard → Table Editor → sahha_events.