Post-Call Transcripts to Your Agent

import express from 'express'
import crypto from 'node:crypto'

const app = express()
const SECRET = process.env.AGENTCALL_WEBHOOK_SECRET! // from Step 1

// IMPORTANT: keep the raw body for HMAC. Standard JSON parsing breaks it.
app.post(
  '/agentcall/transcript',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const provided = req.header('X-AgentCall-Signature') || ''
    if (!provided.startsWith('sha256=')) return res.status(401).end()

    const expected =
      'sha256=' +
      crypto.createHmac('sha256', SECRET).update(req.body).digest('hex')

    const a = Buffer.from(expected)
    const b = Buffer.from(provided)
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).end()
    }

    const body = JSON.parse(req.body.toString('utf8'))
    // Envelope: { event, timestamp, data: { callId, transcript, summary, ... } }
    const { callId, transcript, summary } = body.data
    // feed callId / transcript / summary into your agent
    res.status(200).end()
  },
)

export default {
  async fetch(req: Request, env: { SECRET: string }) {
    const body = await req.text()
    const provided = req.headers.get('X-AgentCall-Signature') || ''
    if (!provided.startsWith('sha256=')) return new Response('unauthorized', { status: 401 })

    const key = await crypto.subtle.importKey(
      'raw',
      new TextEncoder().encode(env.SECRET),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['sign'],
    )
    const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(body))
    const expected =
      'sha256=' +
      Array.from(new Uint8Array(sig))
        .map((b) => b.toString(16).padStart(2, '0'))
        .join('')

    let diff = expected.length === provided.length ? 0 : 1
    for (let i = 0; i < expected.length && i < provided.length; i++) {
      diff |= expected.charCodeAt(i) ^ provided.charCodeAt(i)
    }
    if (diff !== 0) return new Response('unauthorized', { status: 401 })

    const parsed = JSON.parse(body)
    // Envelope: { event, timestamp, data: { callId, transcript, summary, ... } }
    const { callId, transcript, summary } = parsed.data
    return new Response('ok')
  },
}