cronofy-webhooks

Cronofy Webhooks (Push Notifications)

Cronofy is calendar API / scheduling infrastructure. Its webhooks are called push notifications and are delivered to a notification channel's callback_url.

Not Calendly. Cronofy (cronofy.com, docs.cronofy.com) is a different company from Calendly, with a different signing scheme, different headers, and different payloads. If you're looking for Calendly-Webhook-Signature, you want calendly-webhooks.

When to Use This Skill

• How do I receive Cronofy push notifications / webhooks?
• How do I verify the Cronofy-HMAC-SHA256 header?
• Why is my Cronofy webhook signature verification failing?
• How do I handle a Cronofy change notification and fetch what actually changed?
• How do I create a Cronofy notification channel?
• Why did my Cronofy channel stop sending notifications / get closed?
• What is changes_since and how do I use it with Read Events?

Verification (core)

Cronofy computes HMAC-SHA256 over the raw request body, keyed with your application's client secret (the OAuth secret, prefixed CRN_), base64-encoded. The header is a comma-separated list — one HMAC per active client secret, because Cronofy supports secret rotation. Pass if any element matches.

const crypto = require('crypto');

function verifyCronofyWebhook(rawBody, hmacHeader, clientSecret) {
  if (!hmacHeader || !clientSecret) return false;

  const expected = Buffer.from(
    crypto.createHmac('sha256', clientSecret).update(rawBody).digest('base64')
  );

  // Comma-separated: one HMAC per ACTIVE client secret (rotation). Any match wins.
  // reduce (not some) so every candidate is compared — no early exit.
  return hmacHeader.split(',').reduce((matched, candidate) => {
    const buf = Buffer.from(candidate.trim());
    const ok = buf.length === expected.length && crypto.timingSafeEqual(buf, expected);
    return matched || ok;
  }, false);
}