Webhooks

const crypto = require('crypto');

function verifyPaigeSignature(secret, rawBody, header, { toleranceSec = 300, nowSec } = {}) {
  const parts = Object.fromEntries(String(header).split(',').map((p) => {
    const i = p.indexOf('='); return [p.slice(0, i).trim(), p.slice(i + 1).trim()];
  }));
  const t = Number(parts.t); if (!Number.isFinite(t) || !parts.v1) return false;
  const now = Number.isFinite(nowSec) ? nowSec : Math.floor(Date.now() / 1000);
  if (Math.abs(now - t) > toleranceSec) return false;
  const body = Buffer.isBuffer(rawBody) ? rawBody.toString('utf8') : String(rawBody);
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${body}`).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const express = require('express');
const app = express();

// Note: express.raw, NOT express.json — you need the untouched bytes.
app.post('/webhooks/paige', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifyPaigeSignature(
    process.env.PAIGE_WEBHOOK_SECRET,
    req.body,
    req.get('X-Paige-Signature')
  );
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString('utf8'));
  // Acknowledge fast, then do the work out of band.
  res.sendStatus(200);
  handle(event).catch(console.error);
});

curl -X POST https://api.paigeme.dev/v1/webhooks \
  -H "Authorization: Bearer pk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/webhooks/paige",
    "events": ["message.received", "order_confirmed"],
    "is_active": true
  }'

{
  "success": true,
  "data": {
    "webhook": {
      "id": "3b7d…",
      "url": "https://example.com/webhooks/paige",
      "events": ["message.received", "order_confirmed"],
      "is_active": true,
      "failure_count": 0
    },
    "secret": "whsec_…"
  }
}