Creating Sahha Webhooks and Capturing Events

Create a new project

mkdir sahha-express-webhook
cd sahha-express-webhook
npm init -y
npm install express raw-body dotenv

Add a .env file

Create a file in the project root:

SAHHA_WEBHOOK_SECRET="PASTE_YOUR_SECRET_HERE"
PORT=3100

Create server.js

Create server.js and paste the following:

import express from "express";
import getRawBody from "raw-body";
import crypto from "crypto";
import dotenv from "dotenv";

dotenv.config();

const app = express();
const PORT = process.env.PORT || 3000;
const SAHHA_SECRET = process.env.SAHHA_WEBHOOK_SECRET;

if (!SAHHA_SECRET) {
  console.error("Missing SAHHA_WEBHOOK_SECRET in .env");
  process.exit(1);
}

// IMPORTANT: Do NOT use express.json() or body-parser on this route.
// We must verify the signature against the raw request body.
app.post("/sahha-webhook", async (req, res) => {
  try {
    const signature = (req.header("X-Signature") || "").trim();
    const eventType = (req.header("X-Event-Type") || "").trim();
    const externalId = (req.header("X-External-Id") || "").trim();

    if (!signature) {
      return res.status(400).send("Missing X-Signature");
    }

    const rawBody = await getRawBody(req);

    const computed = crypto
      .createHmac("sha256", SAHHA_SECRET)
      .update(rawBody)
      .digest("hex");

    if (computed !== signature) {
      return res.status(401).send("Invalid signature");
    }

    const payload = JSON.parse(rawBody.toString("utf8"));

    console.log("===== Sahha Webhook Received =====");
    console.log("Event Type:", eventType || "(missing)");
    console.log("External ID:", externalId || "(missing)");
    console.log("Payload:", payload);
    console.log("==================================");

    return res.status(200).send("ok");
  } catch (err) {
    console.error("Webhook error:", err);
    return res.status(500).send("server error");
  }
});

app.listen(PORT, () => {
  console.log(`Listening on http://localhost:${PORT}`);
});

Run your server

node server.js

You should see:

Listening on http://localhost:3100

Your local endpoint is: http://localhost:3100/sahha-webhook

Download the starter project — it includes a working Express server with signature verification already set up.

After downloading:

1. Unzip the project and open it in your editor
2. Open the .env file and paste your webhook secret from the Sahha dashboard:

SAHHA_WEBHOOK_SECRET="PASTE_YOUR_SECRET_HERE"
PORT=3100

3. Install dependencies and start the server:

npm install
node server.js

You should see:

Listening on http://localhost:3100

Your local endpoint is: http://localhost:3100/sahha-webhook