Webhooks

curl -X POST "https://api.feeef.org/v1/stores/{storeId}/integrations/webhooks" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Catalog sync",
    "url": "https://your-app.com/webhooks/feeef",
    "events": ["productCreated", "productUpdated", "productDeleted"]
  }'

{
  "event": "orderUpdated",
  "timestamp": "2025-06-29T01:07:59.787Z",
  "data": {
    "store_id": "your-store-id",
    "order": { "id": "...", "customerName": "...", "items": [], "status": "pending" },
    "previous_data": { "status": "draft" }
  },
  "webhook": { "id": "wh_AbC123xYz9", "name": "Order sync" }
}

{
  "event": "productCreated",
  "timestamp": "2025-06-29T01:07:59.787Z",
  "data": {
    "store_id": "your-store-id",
    "product": {
      "id": "...",
      "name": "Seasonal shirt",
      "slug": "seasonal-shirt",
      "price": 2000,
      "stock": 40,
      "status": "published"
    }
  },
  "webhook": { "id": "wh_AbC123xYz9", "name": "Catalog sync" }
}

import crypto from 'node:crypto'

export function verifyFeeefWebhook(rawBody: Buffer, signatureHeader: string, secret: string) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex')
  const received = signatureHeader.replace('sha256=', '')
  return (
    expected.length === received.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))
  )
}

// Express: capture the raw body
app.post('/webhooks/feeef', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyFeeefWebhook(req.body, req.headers['x-feeef-signature-256'] as string, SECRET)) {
    return res.status(401).send('Invalid signature')
  }
  const payload = JSON.parse(req.body.toString('utf8'))
  res.status(200).send('OK') // respond fast, process async
})