Outbound dialer — end-to-end

import crypto from "node:crypto";
import express from "express";

const WEBHOOK_SECRET = process.env.ZOXA_WEBHOOK_SECRET;  // 64-char hex; not exposed by the API

const app = express();
app.use(express.raw({ type: "application/json" }));      // need raw bytes for HMAC verify

app.post("/zoxa/webhook", (req, res) => {
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(req.body)                                    // raw bytes — don't re-serialize
    .digest("hex");
  const got = req.header("X-Zoxa-Signature") ?? "";
  if (!crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(got, "hex"))) {
    return res.status(401).end();
  }

  const payload = JSON.parse(req.body.toString());
  switch (payload.event) {
    case "call.started":
      console.log(`Call ${payload.callId} started (${payload.transport})`);
      break;
    case "call.ended":
      // Cheap, fast — terminal state known. Transcript / recording not yet ready.
      console.log(`Ended: ${payload.callId} reason=${payload.endedReason} duration=${payload.duration}s`);
      break;
    case "call.completed":
      // Final event after post-processing — includes transcript, recordingUrl, summary, usage.
      console.log(`Completed: ${payload.callId}`);
      console.log("Summary:",   payload.summary);
      console.log("Recording:", payload.recordingUrl);
      // hand off to your downstream pipeline here
      break;
  }
  res.status(200).end();                                 // no retries — your 2xx is final
});

app.listen(3000);

import hashlib, hmac, json
from fastapi import FastAPI, Header, HTTPException, Request

WEBHOOK_SECRET = "..."   # 64-char hex; not exposed by the API

app = FastAPI()

@app.post("/zoxa/webhook")
async def webhook(request: Request, x_zoxa_signature: str = Header("")):
    raw = await request.body()
    expected = hmac.new(WEBHOOK_SECRET.encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, x_zoxa_signature):
        raise HTTPException(401)

    payload = json.loads(raw)
    event = payload.get("event")

    if event == "call.started":
        print(payload["callId"], payload["transport"])
    elif event == "call.ended":
        print(payload["callId"], payload["endedReason"], payload["duration"])
    elif event == "call.completed":
        print(payload["callId"], payload.get("summary"))
        print("Recording:", payload.get("recordingUrl"))
    return {"ok": True}