Hootsuite CRM Webhooks API

### Webhook authenticationWhen receiving data from Inbox 2.0, we provide two authentication options. Both mechanisms are in place so that you can make sure the request originates from Inbox 2.0.#### Shared secretIf you choose the shared secret authentication method, a secret will be generated for you. This secret allows you to calculate the signature to verify that the call originated from Inbox 2.0. With this mechanism, every single request from Inbox 2.0 contains the `X-Hootsuite-Signature` header. Here's an example of a request:```shellcurl -X POST https://my-webhook-url \ -H 'content-type : application/json' \ -H 'accept: application/json' \ -H 'X-Hootsuite-Signature: e6f93239a06e46ae9654fc9ad2fb4e1cc4eb213830a0d94e711570c047e43c57' \ -d '{ "version": 2, "contactProfile": { "id": "a7a20053-9c54-11eb-a89f-47717a44c639" }, "contactAttributes": [ {"attribute": "email", "value": "fj@example.com"} ] }'```The signature is generated using the `HMAC-SHA256` algorithm with the shared secret and the request body. Use your secret to calculate the signature and compare with the given signature. Both the secret key you received and the signature are encoded as hexadecimal strings. Make sure to convert the shared secret from its hexadecimal representation to its binary format before using it. Most languages come with libraries out of the box to verify this signature. For example, here's how it looks in JavaScript:```javascriptconst crypto = require("crypto");const secret = "..."; // do not share!const expectedSignature = request.headers["X-Hootsuite-Signature"];const actualSignature = crypto .createHmac("sha256", Buffer.from(secret, "hex")) .update(request.body, "utf-8") .digest("hex");if (actualSignature !== expectedSignature) { throw new createError.Unauthorized("X-Hootsuite-Signature wrong");}console.log(JSON.parse(request.body).email);```#### OAuthIf your endpoints support OAuth2, you can configure your client credentials, a Token URL, and, optionally, a Scope in Inbox 2.0.We use the OAuth2 Client Credentials flow to authenticate against your CRM. The Token URL is the endpoint where we can authenticate with these credentials and retrieve an access token. To do the actual lookup, write back, or notification requests, we use the token in the Authorization Header to authenticate.