CS2 match alerts by webhook.

import crypto from "node:crypto"
import express from "express"

const app = express()
const SECRET = process.env.CITO_WEBHOOK_SECRET
const seen = new Set() // use Redis or your DB in production

app.post("/cito/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const expected = crypto.createHmac("sha256", SECRET).update(req.body).digest("hex")
  const got = req.get("X-Cito-Signature") ?? ""
  const ok = got.length === expected.length && crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected))
  if (!ok) return res.sendStatus(401)

  const id = req.get("X-Cito-Event-Id")
  if (seen.has(id)) return res.sendStatus(200)   // retried delivery, already handled
  seen.add(id)

  res.sendStatus(200)                            // answer first, work after
  const { event, data } = JSON.parse(req.body.toString("utf8"))
  if (event === "cs2.match.completed") notify(data)
})

function notify(data) { console.log("match completed", data) }
app.listen(3000)

import hashlib, hmac, os, json
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["CITO_WEBHOOK_SECRET"].encode()

@app.post("/cito/webhook")
def cito_webhook():
    body = request.get_data()                         # raw bytes, before parsing
    expected = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-Cito-Signature", "")):
        abort(401)
    payload = json.loads(body)
    print(payload["event"], payload["data"])
    return "", 200

async function notify(data) {
  await fetch(process.env.DISCORD_WEBHOOK_URL, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({ content: "CS2 match finished: " + JSON.stringify(data) }),
  })
}