Your first webhook

// The endpoint's whsec_… secret; during a rotation, pass both: [current, previous].
const secrets = [process.env["FURNIOPS_WEBHOOK_SECRET"] ?? ""];

createServer(async (req, res) => {
  // Verify the exact bytes received: a re-serialised body never matches the signature.
  const chunks: Buffer[] = [];
  for await (const chunk of req) chunks.push(chunk as Buffer);
  const raw = Buffer.concat(chunks);

  let event: WebhookEvent;
  try {
    event = await furniops.webhooks.verify(raw, req.headers, secrets);
  } catch (error) {
    if (error instanceof WebhookVerificationError) {
      // reason: "headers" | "timestamp" | "signature" | "payload" | "secret"
      res.writeHead(400).end(error.reason);
      return;
    }
    throw error;
  }

  // The event ID is the deduplication key: a retry delivers the same event again.
  if (!seen.has(event.id)) {
    seen.add(event.id);
    await enqueue(event); // do the work after answering, not before
  }
  // Any 2xx is a success; answer within seconds, or the delivery is retried.
  res.writeHead(204).end();
}).listen(3000);

furniops login --with-api-key            # a fo_test_ key, from stdin or typed hidden
furniops listen --forward-to localhost:3000/webhooks

Ready. Forwarding events to http://localhost:3000/webhooks. Your webhook signing secret is whsec_… (^C to quit)

FURNIOPS_WEBHOOK_SECRET=whsec_… node server.ts
furniops trigger offer.changed

curl https://api.furniops.com/v1/webhook-endpoints \
  -H "Authorization: Bearer $FURNIOPS_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/furniops",
    "event_types": ["offer.changed", "offer.created", "product.discontinued"]
  }'

const endpoint = await furniops.webhookEndpoints.create({
  url: "https://example.com/hooks/furniops",
  description: "Price and stock sync",
  event_types: ["offer.changed", "offer.created", "product.discontinued"],
  payload: "thin",
});
// The signing secret is returned once, on creation (and on rotation). Store it as a secret.
console.log(endpoint.id, endpoint.secret.slice(0, 6));

// Sends a `webhook.test` event now, signed like any other, whatever the endpoint subscribes to.
const delivery = await furniops.webhookEndpoints.sendTest(endpoint.id);
const detail = await furniops.webhookEndpoints.getDelivery(endpoint.id, delivery.id);
console.log(detail.status, detail.last_status);