Quickstart: Webhooks

curl -sS -X POST "https://api.simplepay.mx/v1/webhook_endpoints" \
  -H "Authorization: Bearer $SIMPLEPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: webhook_endpoint_prod_v1" \
  -d '{
    "url": "https://example.com/api/simplepay/webhook",
    "enabled_events": [
      "booking.confirmed",
      "booking.expired",
      "booking.cancelled"
    ],
    "description": "Production webhook"
  }'

import crypto from "node:crypto";

export function verifySimplePaySignature(args: {
  rawBody: string;
  signatureHeader: string;
  secret: string;
}) {
  const parts = Object.fromEntries(
    args.signatureHeader.split(",").map((part) => {
      const [key, value] = part.split("=");
      return [key, value];
    }),
  );

  const signedPayload = `${parts.t}.${args.rawBody}`;
  const expected = crypto
    .createHmac("sha256", args.secret)
    .update(signedPayload)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(parts.v1, "hex"),
  );
}