Webhooks

curl -X POST "https://omnicommerce.sg/api/v1/webhooks" \
  -H "Authorization: Bearer $OMNI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://api.spresso.ai/webhooks/omnicommerce",
    "description": "Spresso commerce ingestion",
    "events": [
      "product.created",
      "product.updated",
      "product.deleted",
      "product.price.changed",
      "product.inventory.changed",
      "order.created",
      "order.updated",
      "order.status.changed",
      "order.deleted",
      "return.created",
      "return.updated",
      "return.status.changed",
      "settlement.created",
      "settlement.updated",
      "settlement.status.changed",
      "look.created",
      "look.deleted"
    ]
  }'

X-Omni-Event-Id: evt_...
X-Omni-Event-Type: product.updated
X-Omni-Timestamp: 1780000000
X-Omni-Signature: <hex HMAC-SHA256>

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyOmniWebhook(input: {
  secret: string;
  timestamp: string;
  rawBody: string;
  signature: string;
}): boolean {
  const ageSeconds = Math.abs(Date.now() / 1000 - Number(input.timestamp));
  if (!Number.isFinite(ageSeconds) || ageSeconds > 300) return false;

  const expected = Buffer.from(
    createHmac("sha256", input.secret)
      .update(`${input.timestamp}.${input.rawBody}`)
      .digest("hex"),
    "hex",
  );
  const actual = Buffer.from(input.signature, "hex");
  return expected.length === actual.length && timingSafeEqual(expected, actual);
}