WhatsApp in your product, minus the Meta plumbing.

POST https://your-app.example.in/webhooks/tabli
Content-Type: application/json
User-Agent: Tabli-Webhooks/1.0
X-Tabli-Event: message.received
X-Tabli-Timestamp: 1788343452
X-Tabli-Signature: v1=3f1c9a…e07b

{
  "event": "message.received",
  "business_id": "biz_01j8w…",
  "created_at": "2026-09-07T10:04:12.000Z",
  "data": {
    "message": { "id": "msg_…", "direction": "inbound", "type": "text", "body": "Class 12. Fees?", "timestamp": "…" },
    "contact": { "id": "ct_…", "phone": "919876543210", "name": "Aarav Mehta" },
    "conversation": { "id": "conv_…", "status": "open" }
  }
}

import crypto from "node:crypto";

// Use the RAW request body (not re-serialised JSON).
export function verifyTabliSignature(rawBody: string, headers: Record<string, string | undefined>, secret: string) {
  const ts = headers["x-tabli-timestamp"];
  const sig = headers["x-tabli-signature"]; // "v1=<hex>"
  if (!ts || !sig) return false;

  // Reject deliveries older than 5 minutes (replay protection)
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = "v1=" + crypto.createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected); const b = Buffer.from(sig);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express example
app.post("/webhooks/tabli", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyTabliSignature(req.body.toString("utf8"), req.headers as Record<string, string>, process.env.TABLI_WEBHOOK_SECRET!)) return res.status(401).end();
  const evt = JSON.parse(req.body.toString("utf8"));
  // handle evt.event / evt.data — respond 2xx quickly; do slow work async
  res.status(200).end();
});