Receive Vote Notifications with Webhooks

​

How webhooks work

1. A user votes for your project on Top.gg.
2. Top.gg sends an HTTP POST request to your configured webhook URL.
3. Your server processes the payload and returns a 2xx response within 5 seconds.

​

Setting up your endpoint

​

Signature verification (v1)

1. Capture the raw request body as a string (do not parse it first).
2. Parse the x-topgg-signature header to extract the timestamp (t) and signature (v1).
3. Compute an HMAC SHA-256 digest of {timestamp}.{rawBody} using your webhook secret as the key.
4. Compare the computed digest to the v1 value using a constant-time comparison.

import crypto from 'crypto';

function verifyWebhook(rawBody: string, signature: string, secret: string): boolean {
  const [tPart, v1Part] = signature.split(',');
  const timestamp = tPart.split('=')[1];
  const receivedSig = v1Part.split('=')[1];
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(receivedSig));
}

​

Reliability