@line/bot-sdk Expressミドルウェア実装例（v11）

mkdir line-webhook && cd line-webhook
npm init -y
npm pkg set type=module
npm install express @line/bot-sdk
npm install -D typescript tsx @types/express @types/node

# .env（このファイルはコミットしないこと）
LINE_CHANNEL_SECRET=your-channel-secret
LINE_CHANNEL_ACCESS_TOKEN=your-channel-access-token
PORT=3000

{
  "scripts": {
    "dev": "tsx watch --env-file=.env src/index.ts"
  }
}

// src/index.ts
import express from "express"
import {
  JSONParseError,
  LineBotClient,
  SignatureValidationFailed,
  middleware,
  webhook,
} from "@line/bot-sdk"

const channelSecret = process.env.LINE_CHANNEL_SECRET
const channelAccessToken = process.env.LINE_CHANNEL_ACCESS_TOKEN
if (!channelSecret || !channelAccessToken) {
  throw new Error("Set LINE_CHANNEL_SECRET and LINE_CHANNEL_ACCESS_TOKEN")
}

const client = LineBotClient.fromChannelAccessToken({ channelAccessToken })
const app = express()

// LINEのミドルウェアはWebhookのルートに置き、JSONのボディパーサーより前に通す
app.post("/webhook", middleware({ channelSecret }), async (req, res) => {
  const { events } = req.body as webhook.CallbackRequest
  await Promise.all(events.map(handleEvent))
  res.sendStatus(200)
})

// ほかのルートでは通常どおりJSONをパースしてよい
app.use(express.json())

async function handleEvent(event: webhook.Event) {
  if (event.type !== "message" || event.message.type !== "text" || !event.replyToken) return

  const { sentMessages } = await client.replyMessage({
    replyToken: event.replyToken,
    messages: [{ type: "text", text: `Echo: ${event.message.text}` }],
  })
  console.log("sent message IDs:", sentMessages.map((m) => m.id))
}

// ミドルウェアはエラーをnext()に渡すだけで、401を自分では返さない
app.use((err: unknown, _req: express.Request, res: express.Response, next: express.NextFunction) => {
  if (err instanceof SignatureValidationFailed) {
    res.status(401).send("Invalid signature")
    return
  }
  if (err instanceof JSONParseError) {
    res.status(400).send("Invalid JSON")
    return
  }
  next(err)
})

const port = Number(process.env.PORT ?? 3000)
app.listen(port, () => console.log(`LINE bot listening on :${port}`))

import { createHmac, timingSafeEqual } from "node:crypto"

// validateSignature()がしていることを数行で
export function isValidSignature(body: string | Buffer, channelSecret: string, signature: string): boolean {
  const expected = createHmac("sha256", channelSecret).update(body).digest()
  const received = Buffer.from(signature, "base64")
  return expected.length === received.length && timingSafeEqual(expected, received)
}

// app/api/line/webhook/route.ts (Next.js App Router)
import { LineBotClient, validateSignature, webhook } from "@line/bot-sdk"

const channelSecret = process.env.LINE_CHANNEL_SECRET ?? ""
const client = LineBotClient.fromChannelAccessToken({
  channelAccessToken: process.env.LINE_CHANNEL_ACCESS_TOKEN ?? "",
})

export async function POST(request: Request) {
  const body = await request.text() // raw body: JSON.parseより前に検証する
  const signature = request.headers.get("x-line-signature") ?? ""

  if (!validateSignature(body, channelSecret, signature)) {
    return new Response("Invalid signature", { status: 401 })
  }

  const { events } = JSON.parse(body) as webhook.CallbackRequest
  await Promise.all(
    events.map(async (event) => {
      if (event.type !== "message" || event.message.type !== "text" || !event.replyToken) return
      await client.replyMessage({
        replyToken: event.replyToken,
        messages: [{ type: "text", text: `Echo: ${event.message.text}` }],
      })
    }),
  )
  return new Response("OK")
}

import os

from flask import Flask, abort, request
from linebot.v3 import WebhookHandler
from linebot.v3.exceptions import InvalidSignatureError
from linebot.v3.messaging import (
    ApiClient,
    Configuration,
    MessagingApi,
    ReplyMessageRequest,
    TextMessage,
)
from linebot.v3.webhooks import MessageEvent, TextMessageContent

app = Flask(__name__)
configuration = Configuration(access_token=os.environ["LINE_CHANNEL_ACCESS_TOKEN"])
handler = WebhookHandler(os.environ["LINE_CHANNEL_SECRET"])


@app.post("/webhook")
def webhook():
    signature = request.headers.get("X-Line-Signature", "")
    body = request.get_data(as_text=True)  # request.jsonではなくraw bodyを使う
    try:
        handler.handle(body, signature)  # 署名を検証してからハンドラーに振り分ける
    except InvalidSignatureError:
        abort(400)
    return "OK"


@handler.add(MessageEvent, message=TextMessageContent)
def handle_text(event):
    with ApiClient(configuration) as api_client:
        MessagingApi(api_client).reply_message(
            ReplyMessageRequest(
                reply_token=event.reply_token,
                messages=[TextMessage(text=f"Echo: {event.message.text}")],
            )
        )

<?php
require __DIR__ . '/vendor/autoload.php';

use LINE\Parser\Exception\InvalidSignatureException;
use LINE\Parser\SignatureValidator;

$body = file_get_contents('php://input'); // raw request body
$signature = $_SERVER['HTTP_X_LINE_SIGNATURE'] ?? '';
$channelSecret = (string) getenv('LINE_CHANNEL_SECRET');

try {
    $isValid = SignatureValidator::validateSignature($body, $channelSecret, $signature);
} catch (InvalidSignatureException $e) {
    $isValid = false; // 署名ヘッダーが空
}

if (!$isValid) {
    http_response_code(400);
    exit;
}
// 署名OK: $bodyをデコードしてイベントを処理する

import { LineBotClient, webhook } from "@line/bot-sdk"

const client = LineBotClient.fromChannelAccessToken({ channelAccessToken: process.env.LINE_CHANNEL_ACCESS_TOKEN ?? "" })

export async function confirmBooking(event: webhook.MessageEvent) {
  if (!event.replyToken) return

  const { sentMessages } = await client.replyMessage({
    replyToken: event.replyToken,
    messages: [
      { type: "text", text: "ありがとうございます。ご予約を承りました。" },
      {
        type: "flex",
        altText: "ご予約確定：土曜日 14:00",
        contents: {
          type: "bubble",
          body: {
            type: "box",
            layout: "vertical",
            contents: [
              { type: "text", text: "ご予約確定", weight: "bold", size: "lg" },
              { type: "text", text: "土曜日 14:00", color: "#666666", wrap: true },
            ],
          },
          footer: {
            type: "box",
            layout: "vertical",
            contents: [
              {
                type: "button",
                style: "primary",
                action: { type: "uri", label: "予約を確認", uri: "https://example.com/bookings/123" },
              },
            ],
          },
        },
      },
    ],
    notificationDisabled: false, // true = プッシュ通知なしで届ける
  })

  return sentMessages
}

type ReplyMessageResponse = {
  sentMessages: Array<{
    id: string          // 送信したメッセージのID
    quoteToken?: string // 引用できるメッセージタイプの場合のみ
  }>
}

import { randomUUID } from "node:crypto"
import { LineBotClient, webhook } from "@line/bot-sdk"

const client = LineBotClient.fromChannelAccessToken({ channelAccessToken: process.env.LINE_CHANNEL_ACCESS_TOKEN ?? "" })

export async function confirmOrder(event: webhook.MessageEvent, userId: string) {
  if (event.message.type !== "text" || !event.replyToken) return

  // 応答でユーザーのメッセージを引用する
  const { sentMessages } = await client.replyMessage({
    replyToken: event.replyToken,
    messages: [{ type: "text", text: "ご注文 #1042 を承りました。", quoteToken: event.message.quoteToken }],
  })
  const orderQuoteToken = sentMessages[0]?.quoteToken // 注文データと一緒に保存しておく

  // 後で（例：発送時）、確認メッセージを引用したプッシュメッセージを送る
  await client.pushMessage(
    { to: userId, messages: [{ type: "text", text: "ご注文の商品を発送しました。", quoteToken: orderQuoteToken }] },
    randomUUID(), // X-Line-Retry-Key: 同じキーで再試行しても二重送信されない
  )
}

import { HTTPFetchError, LineBotClient } from "@line/bot-sdk"

const client = LineBotClient.fromChannelAccessToken({ channelAccessToken: process.env.LINE_CHANNEL_ACCESS_TOKEN ?? "" })

export async function safeReply(replyToken: string, text: string) {
  try {
    await client.replyMessage({ replyToken, messages: [{ type: "text", text }] })
  } catch (err) {
    if (err instanceof HTTPFetchError) {
      // 例: 400 {"message":"Invalid reply token"} や 429 {"message":"You have reached your monthly limit."}
      console.error("LINE API error", err.status, err.body)
      return
    }
    throw err
  }
}

ユーザーがメッセージを送信
      │
      ▼
LINEプラットフォーム ── HTTPS POST + x-line-signature ──▶ POST /webhook（あなたのサーバー）
                                                          │ middleware(): raw body → HMAC検証 → JSON
                                                          │ すぐに200 OKを返す
                                                          ▼
                                                    handleEvent(event)
                                                          │ 独自のロジック、データベース、AI
                                                          ▼
LINEプラットフォーム ◀── replyMessage / pushMessage ───────┘
      │
      ▼
ユーザーに応答が届く

const seen = new Set<string>() // 本番ではRedisやデータベースに保存する

app.post("/webhook", middleware({ channelSecret }), (req, res) => {
  const { events } = req.body as webhook.CallbackRequest
  res.sendStatus(200) // 先に受領を返す：LINEが必要とするのは200だけ

  for (const event of events) {
    if (seen.has(event.webhookEventId)) continue // 重複または再送されたイベント
    seen.add(event.webhookEventId)
    handleEvent(event).catch((err) => console.error("event failed", event.webhookEventId, err))
  }
})