Top.gg Webhooks V2 Example

This repo explains how to securely receive and verify webhooks from Top.gg using Node.js and Express. Webhooks allow your application to receive real-time updates directly from Top.gg.

1. Prerequisites

Before running the code, ensure you have the dependencies are installed:

yarn install

To run the example you can use the start command

WEBHOOK_SECRET=whs_{insert your token here} node index.js

---

2. How Verification Works

Security is critical when handling webhooks. To ensure a request actually came from Top.gg and is not an impostor, we use HMAC SHA-256 signature validation.

1. Capture Raw Body: We must capture the exact raw data Top.gg sent before any formatting changes.
2. Extract Header: Look for the x-topgg-signature header, which contains a timestamp and the "signature" (a hash code).
3. Local Hash: We create our own hash using your webhook secret, the timestamp, and the raw request body.
4. Compare: If our local hash matches the signature in the header, the request can be ingested.