Webhooks

curl -sS -X POST "https://api.simplepay.mx/v1/webhook_endpoints" \
  -H "Authorization: Bearer $SIMPLEPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: webhook_endpoint_prod_v1" \
  -d '{
    "url": "https://api.example.com/webhooks/simplepay",
    "description": "Production webhook endpoint",
    "enabled_events": [
      "booking.hold_created",
      "booking.confirmed",
      "booking.expired",
      "booking.cancelled"
    ]
  }'

{
  "id": "spwevt_0123456789abcdef0123456789abcdef",
  "type": "booking.confirmed",
  "data": {
    "booking": {
      "id": "00000000-0000-4000-8000-000000000010",
      "status": "confirmed",
      "paymentStatus": "paid"
    }
  }
}

SimplePay-Signature: t=1782000000,v1=hex_hmac_sha256

{timestamp}.{raw_json_payload}

import crypto from "node:crypto";

export function verifySimplePayWebhook(input: {
  rawBody: string;
  signatureHeader: string | null;
  secret: string;
  toleranceSeconds?: number;
}) {
  if (!input.signatureHeader) {
    throw new Error("Missing SimplePay-Signature header");
  }

  const parts = Object.fromEntries(
    input.signatureHeader.split(",").map((part) => {
      const [key, value] = part.split("=");
      return [key, value];
    }),
  );

  const timestamp = Number(parts.t);
  const signature = parts.v1;

  if (!timestamp || !signature) {
    throw new Error("Invalid SimplePay signature header");
  }

  const toleranceSeconds = input.toleranceSeconds ?? 300;
  const age = Math.abs(Math.floor(Date.now() / 1000) - timestamp);

  if (age > toleranceSeconds) {
    throw new Error("SimplePay webhook timestamp outside tolerance");
  }

  const expected = crypto
    .createHmac("sha256", input.secret)
    .update(`${timestamp}.${input.rawBody}`)
    .digest("hex");

  if (
    !crypto.timingSafeEqual(
      Buffer.from(expected, "hex"),
      Buffer.from(signature, "hex"),
    )
  ) {
    throw new Error("Invalid SimplePay webhook signature");
  }
}

curl -sS "https://api.simplepay.mx/v1/webhook_endpoints" \
  -H "Authorization: Bearer $SIMPLEPAY_API_KEY"

curl -sS -X POST "https://api.simplepay.mx/v1/events/spwevt_0123456789abcdef0123456789abcdef/replay" \
  -H "Authorization: Bearer $SIMPLEPAY_API_KEY"