intercom-webhooks-events

# Intercom Webhooks & Events ## Overview Handle incoming Intercom webhooks (notifications) with signature verification and implement outbound data event tracking via the Events API. ## Prerequisites - HTTPS endpoint accessible from internet - Webhook secret from Intercom Developer Hub - `intercom-client` SDK installed - Redis or database for idempotency (recommended) ## Part 1: Incoming Webhooks (Notifications) ### Step 1: Webhook Endpoint with Signature Verification Intercom signs webhooks with HMAC-SHA1 via the `X-Hub-Signature` header. ```typescript import express from "express"; import crypto from "crypto"; const app = express(); // IMPORTANT: Use raw body for signature verification app.post( "/webhooks/intercom", express.raw({ type: "application/json" }), async (req, res) => { const signature = req.headers["x-hub-signature"] as string; const secret = process.env.INTERCOM_WEBHOOK_SECRET!; if (!signature) { return res.status(401).json({ error: "Missing X-Hub-Signature" }); } // Verify HMAC-SHA1 signature const expected = "sha1=" + crypto .createHmac("sha1", secret) .update(req.body) .digest("hex"); if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) { console.error("Webhook signature verification failed"); return res.status(401).json({ error: "Invalid signature" }); } // MUST respond within 5 seconds or Intercom treats as failure // Parse and queue for as...