Trying to process /api/v2/webhooks payloads in a Lambda function using Node.js. The signature validation logic works locally but fails in production with a generic 400 response from Genesys, suggesting the signature is invalid. Here’s the verification code:
const crypto = require('crypto');
const secret = process.env.GENESYS_WEBHOOK_SECRET;
const signature = headers['x-genesys-signature'];
const body = JSON.stringify(event.body);
const expected = crypto.createHmac('sha256', secret).update(body).digest('hex');
if (signature !== expected) {
return { statusCode: 403, body: 'Invalid signature' };
}
Genesys is still rejecting the callback. Is the event.body being parsed incorrectly before signing?