Every lead is delivered to a Google Sheet or a signed webhook.

const crypto = require('crypto');

// Mount this route with express.raw({ type: 'application/json' }).
function verified(req, secret) {
  const sent = req.get('X-OpusDone-Signature') || '';
  const ts = req.get('X-OpusDone-Timestamp') || '';
  const age = Math.abs(Date.now() - Date.parse(ts));
  if (!(age < 5 * 60 * 1000)) return false;

  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(ts + '.')
    .update(req.body)        // raw bytes, not the parsed object
    .digest('hex');

  const a = Buffer.from(sent);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}