Create a Webflow webhook and verify its signature safely on the receiving endpoint

Documented steps

1. POST https://api.webflow.com/v2/sites/{site_id}/webhooks (scope sites:write) with triggerType, url, and optionally filter (usable only with form_submission, to filter by form name). This requires a Data Client App token, not a Designer token.
2. Valid triggerType values: form_submission, site_publish, page_created, page_metadata_updated, page_deleted, ecomm_new_order, ecomm_order_changed, ecomm_inventory_changed, collection_item_created, collection_item_changed, collection_item_deleted, collection_item_published, collection_item_unpublished, comment_created.
3. On each delivery, read the x-webflow-timestamp header (Unix epoch milliseconds) and the x-webflow-signature header (SHA-256 HMAC hex digest).
4. Recompute the digest as HMAC-SHA256(secret, timestamp + ':' + JSON.stringify(requestBody)). The secret is your OAuth app's client secret for app-created webhooks, or the per-webhook secret key for webhooks created with a Site Token.
5. Reject the request if now - x-webflow-timestamp exceeds 300000 ms (5 minutes) to block replays.
6. Compare digests with a timing-safe comparison function, then return HTTP 200 quickly and process asynchronously.