How to Send a Signing Packet from an Agent With Webhooks

curl -X POST https://signb.ee/api/v1/send \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "markdown": "# Mutual Non-Disclosure Agreement\n\nTerms...",
    "sender_name": "Autonomous Operations Corp",
    "sender_email": "ops@auto-corp.io",
    "recipient_name": "Bob Smith",
    "recipient_email": "bob@acme.com",
    "webhook_url": "https://api.auto-corp.io/v1/webhooks/signbee"
  }'

{
  "document_id": "doc_8f91a2bc4e",
  "status": "pending_recipient",
  "sender": "Autonomous Operations Corp",
  "recipient": "Bob Smith",
  "expires_at": "2026-09-18T12:00:00.000Z",
  "webhook_secret": "whsec_9a8b7c6d5e4f3a2b1c0d..."
}

{
  "event": "document.signed",
  "document_id": "doc_8f91a2bc4e",
  "title": "Mutual Non-Disclosure Agreement",
  "status": "signed",
  "sender_email": "ops@auto-corp.io",
  "recipient_name": "Bob Smith",
  "recipient_email": "bob@acme.com",
  "recipient_signed_at": "2026-09-04T12:34:56.000Z",
  "signed_pdf_url": "https://signb.ee/uploads/signed_doc_8f91a2bc4e.pdf",
  "signature_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "verify_url": "https://signb.ee/verify/doc_8f91a2bc4e",
  "timestamp": "2026-09-04T12:34:57.000Z"
}

import crypto from "crypto";

export function verifyWebhookSignature(
  rawPayload: string | Buffer,
  signatureHeader: string,
  webhookSecret: string
): boolean {
  if (!signatureHeader || !webhookSecret) return false;

  const computedHash = crypto
    .createHmac("sha256", webhookSecret)
    .update(rawPayload)
    .digest("hex");

  const expectedBuffer = Buffer.from(computedHash, "utf8");
  const signatureBuffer = Buffer.from(signatureHeader, "utf8");

  if (expectedBuffer.length !== signatureBuffer.length) {
    return false;
  }

  return crypto.timingSafeEqual(expectedBuffer, signatureBuffer);
}

import hmac
import hashlib

def verify_signbee_webhook(raw_body: bytes, signature_header: str, secret: str) -> bool:
    """Performs constant-time HMAC-SHA256 validation to prevent timing attacks."""
    if not signature_header or not secret:
        return False

    computed = hmac.new(secret.encode("utf-8"), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(computed.lower(), signature_header.lower())

import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";
import { inngest } from "@/lib/inngest/client"; // Or Upstash QStash / BullMQ

export const dynamic = "force-dynamic";

export async function POST(req: NextRequest) {
  try {
    const rawBody = await req.text();
    const signature = req.headers.get("x-signbee-signature");
    const secret = process.env.SIGNBEE_WEBHOOK_SECRET;

    if (!signature || !secret) {
      return NextResponse.json({ error: "Missing signature credentials" }, { status: 401 });
    }

    // Step 1: Constant-time HMAC verification
    const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
    const a = Buffer.from(expected, "utf8");
    const b = Buffer.from(signature, "utf8");

    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return NextResponse.json({ error: "Invalid cryptographic signature" }, { status: 403 });
    }

    const event = JSON.parse(rawBody);

    // Step 2: Prevent replay attacks (reject payloads older than 5 minutes)
    const eventTime = new Date(event.timestamp).getTime();
    if (Math.abs(Date.now() - eventTime) > 300_000) {
      return NextResponse.json({ error: "Stale event timestamp rejected" }, { status: 400 });
    }

    // Step 3: Enqueue for asynchronous background agent execution
    await inngest.send({
      name: "contract.signed",
      data: {
        documentId: event.document_id,
        pdfUrl: event.signed_pdf_url,
        signatureHash: event.signature_hash,
        recipientEmail: event.recipient_email,
        signedAt: event.recipient_signed_at,
      },
    });

    // Step 4: Acknowledge receipt immediately
    return NextResponse.json({ received: true, id: event.document_id });
  } catch (err: any) {
    console.error("[Webhook Error]:", err.message);
    return NextResponse.json({ error: "Internal processing failure" }, { status: 500 });
  }
}

# 1. Install and start a zero-config tunnel to your local port 3000
npx cloudflared tunnel --url http://localhost:3000

# Console Output:
# +--------------------------------------------------------------------------------------------+
# |  Your quick Tunnel has been created! Visit it at (it may take some moments to be ready):  |
# |  https://temporary-agent-subdomain.trycloudflare.com                                       |
# +--------------------------------------------------------------------------------------------+

async function waitForSignature(documentId: string, timeoutMinutes = 60): Promise<boolean> {
  const startTime = Date.now();
  const maxTime = startTime + timeoutMinutes * 60 * 1000;

  // Poll fallback loop running every 5 minutes if webhook has not arrived
  while (Date.now() < maxTime) {
    await new Promise((r) => setTimeout(r, 300_000)); // 5 min interval

    const res = await fetch(`https://signb.ee/api/v1/documents/${documentId}`, {
      headers: { "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}` }
    });

    if (res.ok) {
      const data = await res.json();
      if (data.status === "signed") {
        console.log(`Document ${documentId} signed via fallback polling reconciliation!`);
        return true;
      }
    }
  }

  return false;
}