Build withTalkify API.

const BASE = 'https://app.talkify.com.bd/api/v1';

async function talkify(path, options = {}) {
  const res = await fetch(BASE + path, {
    ...options,
    headers: {
      'X-API-Key': process.env.TALKIFY_API_KEY,
      'Content-Type': 'application/json',
      ...options.headers,
    },
  });

  const body = await res.json();
  if (!res.ok) {
    // A validation failure returns message as an array of strings;
    // an auth failure returns a single string.
    const detail = Array.isArray(body.message) ? body.message.join('; ') : body.message;
    throw new Error(`Talkify ${res.status}: ${detail}`);
  }
  return body;
}

const { data } = await talkify('/outbound/call', {
  method: 'POST',
  body: JSON.stringify({
    phone: '8801712345678',
    text: 'আপনার অর্ডারটি পাঠানো হয়েছে। ধন্যবাদ।',
    externalId: 'order-10482',      // your id — send it again and you get the
    webhookUrl: 'https://your-app.com/talkify/webhook',
  }),                                // same call back, never a second dial
});

console.log(data.callId, data.status);   // '…-…' 'QUEUED'

// One call
const { data: call } = await talkify('/outbound/call/' + callId);
console.log(call.status, call.dtmfPressed, call.duration);

// Everything for one order — this endpoint returns { data, pagination }
const { data: calls, pagination } = await talkify(
  '/outbound/calls?externalId=order-10482'
);
console.log(`${calls.length} of ${pagination.total}`);

import express from 'express';
import crypto from 'node:crypto';

const app = express();

// express.raw, not express.json — the signature covers the exact bytes sent.
app.post('/talkify/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const expected = 'sha256=' + crypto
      .createHmac('sha256', process.env.TALKIFY_WEBHOOK_SECRET)
      .update(req.body)                       // the Buffer, untouched
      .digest('hex');

    const got = req.get('X-Talkify-Signature') || '';
    // Constant-time: a plain === leaks the answer one byte at a time.
    const ok = got.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));

    if (!ok) return res.status(401).send('bad signature');

    const event = JSON.parse(req.body.toString());
    console.log(event.externalId, event.status, event.dtmfLabel);

    res.sendStatus(200);   // anything else and Talkify retries: 2s, 4s, 8s
  });

<?php
function talkify(string $path, ?array $body = null): array {
    $ch = curl_init('https://app.talkify.com.bd/api/v1' . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => [
            'X-API-Key: ' . getenv('TALKIFY_API_KEY'),
            'Content-Type: application/json',
        ],
        CURLOPT_TIMEOUT        => 15,
    ]);
    if ($body !== null) {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS,
            json_encode($body, JSON_UNESCAPED_UNICODE));  // keep Bengali readable
    }

    $raw    = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $json = json_decode($raw, true);
    if ($status >= 400) {
        // Validation errors arrive as an array of messages, auth errors as one string.
        $msg = $json['message'] ?? 'unknown error';
        throw new RuntimeException("Talkify $status: " .
            (is_array($msg) ? implode('; ', $msg) : $msg));
    }
    return $json;
}

$res = talkify('/outbound/call', [
    'phone'      => '8801712345678',
    'text'       => 'আপনার অর্ডারটি পাঠানো হয়েছে। ধন্যবাদ।',
    'externalId' => 'order-10482',
    'webhookUrl' => 'https://your-app.com/talkify/webhook',
]);

echo $res['data']['callId'], ' ', $res['data']['status'];   // '…' 'QUEUED'

<?php
// One call
$call = talkify('/outbound/call/' . $callId)['data'];
echo $call['status'], ' ', $call['dtmfPressed'] ?? '-';

// Everything for one order — { data, pagination }, no success wrapper
$list = talkify('/outbound/calls?externalId=order-10482');
printf("%d of %d\n", count($list['data']), $list['pagination']['total']);

<?php
$raw    = file_get_contents('php://input');   // the bytes as sent
$got    = $_SERVER['HTTP_X_TALKIFY_SIGNATURE'] ?? '';
$expect = 'sha256=' . hash_hmac('sha256', $raw, getenv('TALKIFY_WEBHOOK_SECRET'));

// hash_equals is constant-time; == would leak the signature a byte at a time.
if (!hash_equals($expect, $got)) {
    http_response_code(401);
    exit('bad signature');
}

$event = json_decode($raw, true);
// call.completed — status, dtmfPressed, dtmfLabel, duration, hangupCause
error_log($event['externalId'] . ' ' . $event['status']);

http_response_code(200);   // anything else and Talkify retries: 2s, 4s, 8s