Webhooks

const webhook = await client.createWebhook({
  url: "https://yourapp.com/webhooks/hypermid",
  events: ["swap.completed", "swap.failed", "onramp.completed", "onramp.failed"],
  secret: "whsec_your_signing_secret",
});

console.log("Webhook ID:", webhook.id);
console.log("Created:", webhook.createdAt);

curl -X POST "https://api.hypermid.io/v1/partner/webhooks" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: your-api-key" \
  -d '{
    "url": "https://yourapp.com/webhooks/hypermid",
    "events": ["swap.completed", "swap.failed", "onramp.completed", "onramp.failed"],
    "secret": "whsec_your_signing_secret"
  }'

import crypto from "crypto";
import express from "express";

const app = express();
app.use(express.raw({ type: "application/json" }));

const WEBHOOK_SECRET = "whsec_your_signing_secret";

app.post("/webhooks/hypermid", (req, res) => {
  const signature = req.headers["x-hypermid-signature"] as string;
  const body = req.body;

  // Compute expected signature
  const expectedSignature = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(body)
    .digest("hex");

  // Verify signature
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    console.error("Invalid webhook signature");
    return res.status(401).send("Invalid signature");
  }

  // Parse and process the event
  const event = JSON.parse(body.toString());
  console.log("Received event:", event.event);

  switch (event.event) {
    case "swap.completed":
      handleSwapCompleted(event.data);
      break;
    case "swap.failed":
      handleSwapFailed(event.data);
      break;
    case "onramp.completed":
      handleOnrampCompleted(event.data);
      break;
    default:
      console.log("Unhandled event:", event.event);
  }

  res.status(200).send("OK");
});

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "io"
    "log"
    "net/http"
)

const webhookSecret = "whsec_your_signing_secret"

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Bad request", http.StatusBadRequest)
        return
    }

    signature := r.Header.Get("X-Hypermid-Signature")

    mac := hmac.New(sha256.New, []byte(webhookSecret))
    mac.Write(body)
    expectedSignature := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    var event struct {
        Event     string          `json:"event"`
        Timestamp int64           `json:"timestamp"`
        Data      json.RawMessage `json:"data"`
    }
    json.Unmarshal(body, &event)

    log.Printf("Received event: %s", event.Event)

    w.WriteHeader(http.StatusOK)
    w.Write([]byte("OK"))
}