const express = require("express");
const crypto = require("crypto");
const app = express();
app.use(express.json());
app.post("/webhooks/zochil", (req, res) => {
const signature = req.get("X-Zochil-Signature");
const payload = JSON.stringify(req.body);
// Verify webhook signature (recommended)
if (!verifySignature(payload, signature)) {
return res.status(401).send("Unauthorized");
}
const { event, data } = req.body;
// Handle the event
switch (event) {
case "user.created":
console.log("New user:", data.user);
// Send welcome email, create user profile, etc.
break;
case "order.created":
console.log("New order:", data.order);
// Update inventory, send confirmation, etc.
break;
default:
console.log("Unhandled event:", event);
}
res.status(200).send("OK");
});
function verifySignature(payload, signature) {
const webhookSecret = process.env.ZOCHIL_WEBHOOK_SECRET;
const expectedSignature = crypto
.createHmac("sha256", webhookSecret)
.update(payload)
.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(`sha256=${expectedSignature}`)
);
}
app.listen(3000);
