NaCaller Webhooks

POST <your callback URL>
Content-Type: application/json
X-MissOTP-Signature: 5f2b…  (hex HMAC-SHA256 of the raw body)

{
  "event": "verification.verified",
  "requestId": "cm0x…",
  "phone": "9876543210",
  "reference": "user_123",
  "verifiedAt": "2026-09-11T06:12:09.412Z",
  "timestamp": 1789107129412
}

// Express. The signature covers the EXACT bytes we sent, so read the raw body —
// JSON.stringify(req.body) will not reproduce it byte for byte.
import express from "express";
import crypto from "node:crypto";

const app = express();

app.post("/webhooks/nacaller", express.raw({ type: "application/json" }), (req, res) => {
  const sent = String(req.get("X-MissOTP-Signature") || "");
  const expected = crypto
    .createHmac("sha256", process.env.NACALLER_WEBHOOK_SECRET)
    .update(req.body)            // a Buffer: the raw body
    .digest("hex");

  const ok = sent.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sent), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  const event = JSON.parse(req.body.toString("utf8"));
  if (Date.now() - event.timestamp > 5 * 60 * 1000) return res.status(400).end(); // replay

  // event.requestId is verified — mark that user's phone as verified here.
  res.sendStatus(204);
});

# Flask. Verify against request.get_data() — the raw bytes, not parsed JSON.
import hashlib, hmac, json, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["NACALLER_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/nacaller")
def nacaller_webhook():
    raw = request.get_data()
    expected = hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    sent = request.headers.get("X-MissOTP-Signature", "")
    if not hmac.compare_digest(sent, expected):
        abort(401)

    event = json.loads(raw)
    if time.time() * 1000 - event["timestamp"] > 5 * 60 * 1000:
        abort(400)  # too old — treat as a replay

    # event["requestId"] is verified — mark that user's phone as verified here.
    return "", 204

POST https://api.nacaller.com/api/hooks/lead/<source token>

curl -X POST https://api.nacaller.com/api/hooks/lead/YOUR_SOURCE_TOKEN \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "9876543210",
    "name": "Ravi Kumar",
    "email": "ravi@example.com",
    "campaign": "Diwali offer",
    "platform": "Website",
    "ref": "form-8841"
  }'

{ "ok": true, "leadId": "cm0y…", "called": false, "callAt": "2026-09-11T06:13:40.000Z", "reason": "queued" }