BSC USDT transfer notifications, delivered as webhooks

POST /webhooks/chainhook HTTP/1.1
Host: api.example.com
Content-Type: application/json
User-Agent: chainhook/1.x
X-Webhook-Id: 01a0fbfd-4fe4-7a3c-8f21-6b9d0e4c7a15
X-Webhook-Signature: 7a12d02673420517279805cf8188a1a62c6f69706161ba5cf0a8ec91ea66b8e3

{
  "id": "01a0fbfd-4fe4-7a3c-8f21-6b9d0e4c7a15",
  "event": "transfer.detected",
  "created_at": "2026-10-02T09:41:17Z",
  "webhook_id": "01a0fbf2-fadc-7c3e-9b1a-4d6f2e8a5c71",
  "data": {
    "network": "bsc",
    "direction": "in",
    "type": "token",
    "transaction_hash": "0x7c1e9f4a2b6d8035e4f1a9c27d3b5e8061f4a2c9d7b3e5f8a1c4d6e9b2f7a3c5",
    "transfer_index": 214,
    "block_number": 128946007,
    "block_hash": "0x3a8f2c6e1d9b4f7a0c5e8d2b6f1a9c4e7d0b3f6a2c8e5d1b9f4a7c0e3d6b8f2a",
    "block_timestamp": "2026-10-02T09:41:05Z",
    "confirmations": 15,
    "from": "0xe3b1c5a9f27d4e8b06c1a3f5d9e2b7c4a8f6d0e1",
    "to": "0x9d2a7e41c8b05f3e6a1d4c7b28e0f95a3b6c1d47",
    "currency": "USDT",
    "amount": "1250.75",
    "amount_raw": "1250750000000000000000",
    "decimals": 18,
    "contract_address": "0x55d398326f99059ff775485246999027b3197955"
  }
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post(
  '/webhooks/chainhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.get('X-Webhook-Signature') ?? '';
    const expected = crypto
      .createHmac('sha256', process.env.CHAINHOOK_SIGNING_SECRET)
      .update(req.body)
      .digest('hex');

    const valid =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

    if (!valid) {
      return res.sendStatus(401);
    }

    const event = JSON.parse(req.body);
    // Skip event.id if you've already processed it.

    res.sendStatus(200);
  },
);