Build withTalkify API

const BASE = 'https://app.talkify.com.bd/api/v1';

async function talkify(path, options = {}) {
  const res = await fetch(BASE + path, {
    ...options,
    headers: {
      'X-API-Key': process.env.TALKIFY_API_KEY,
      'Content-Type': 'application/json',
      ...options.headers,
    },
  });

  const body = await res.json();
  if (!res.ok) {
    // A validation failure returns message as an array of strings;
    // an auth failure returns a single string.
    const detail = Array.isArray(body.message) ? body.message.join('; ') : body.message;
    throw new Error(`Talkify ${res.status}: ${detail}`);
  }
  return body;
}

const { data } = await talkify('/outbound/call', {
  method: 'POST',
  body: JSON.stringify({
    phone: '8801712345678',
    text: 'আপনার অর্ডারটি পাঠানো হয়েছে। ধন্যবাদ।',
    externalId: 'order-10482',      // your id — send it again and you get the
    webhookUrl: 'https://your-app.com/talkify/webhook',
  }),                                // same call back, never a second dial
});

console.log(data.callId, data.status);   // '…-…' 'QUEUED'

// One call
const { data: call } = await talkify('/outbound/call/' + callId);
console.log(call.status, call.dtmfPressed, call.duration);

// Everything for one order — this endpoint returns { data, pagination }
const { data: calls, pagination } = await talkify(
  '/outbound/calls?externalId=order-10482'
);
console.log(`${calls.length} of ${pagination.total}`);

import express from 'express';
import crypto from 'node:crypto';

const app = express();

// express.raw, not express.json — the signature covers the exact bytes sent.
app.post('/talkify/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const expected = 'sha256=' + crypto
      .createHmac('sha256', process.env.TALKIFY_WEBHOOK_SECRET)
      .update(req.body)                       // the Buffer, untouched
      .digest('hex');

    const got = req.get('X-Talkify-Signature') || '';
    // Constant-time: a plain === leaks the answer one byte at a time.
    const ok = got.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));

    if (!ok) return res.status(401).send('bad signature');

    const event = JSON.parse(req.body.toString());
    console.log(event.externalId, event.status, event.dtmfLabel);

    res.sendStatus(200);   // anything else and Talkify retries: 2s, 4s, 8s
  });