Validating CRM Action Hooks

[dan9]

I've got an action hooks that looks like this:

{
      type: 'ACTION_HOOK',
      httpMethod: 'POST',
      uri: 'https://xxx.eu.ngrok.io/api/powerups/hubspot/card',
      label: 'Some Value',
}

When selecting that value, Hubspot fires of a POST request and waits for it to return a 200 on my side. Once it has done that, it fires for a GET request to me again. 

The problem I have is that the GET request validates just fine, but the POST doesn't. Leading me to believe it's not my code that's wrong, but somehow validating action hooks work differently. 

My code:

    // v3
    const hmac = crypto.createHmac(
      'sha256',
      process.env.HUBSPOT_CLIENT_SECRET!
    );
    let str: string;
    if (method === 'POST') {
      str = method! + url + JSON.stringify(body) + Number(timestamp);
    } else {
      str = method! + url + Number(timestamp);
    }
    const hash = hmac.update(str).digest('base64');

    // v2
    if (method === 'POST') {
      str = clientSecret + method! + url + JSON.stringify(body);
    } else {
      str = clientSecret + method! + url;
    }
    const hash2 = crypto.createHash('sha256').update(str).digest('hex');

[dan9]

Ended up using a GET request for this. I also successfully validated a webhook with a POST request so surely this must be a bug. 

[Jaycee_Lewis]

Hi, @dan9 👋 Thanks for reaching out. Were you able to make any progress here? If not, we can tag a few community members and try to get the conversation going.

Best,

Jaycee

[hyago_alves]

I am facing a similar issue. I have a public application and I noticed that signature validation is working correctly on GET requests and Webhooks. However, when dealing with ACTION HOOK, signature validation appears to fail as the received signature is different from what was expected.

I believe it's a bug on Hubspot itself.

[dan9]

No, I didn't unfortunately. Please tag some people.