Outbound webhooks

curl -sS -X POST https://app.curobi.com/api/admin/v1/webhooks/endpoints \
  -H "Authorization: Bearer $CUROBI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "url": "https://hooks.example.com/curobi",
        "events": ["subscription.cancelled", "subscription.payment_failed"]
      }'

const res = await fetch("https://app.curobi.com/api/admin/v1/webhooks/endpoints", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${CUROBI_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://hooks.example.com/curobi",
    events: ["subscription.cancelled", "subscription.payment_failed"],
  }),
});
 
const endpoint = await res.json();
 
// The signing secret is in this response and in no other response, ever.
// Persist it before this process exits.
await storeSigningSecret(endpoint);

import { curobi } from "./curobi.js";
 
const url = "https://hooks.example.com/curobi";
 
// Idempotency keys aren't honoured yet, so check before creating rather than
// retrying blindly — see the warning below.
const { data: existing } = await curobi("/webhooks/endpoints");
if (existing.some((endpoint) => endpoint.url === url)) {
  // A second endpoint for the same URL means every event arrives twice.
  throw new Error(`An endpoint for ${url} already exists.`);
}
 
const endpoint = await curobi("/webhooks/endpoints", {
  method: "POST",
  body: JSON.stringify({
    url,
    events: ["subscription.cancelled", "subscription.payment_failed"],
  }),
});
 
await storeSigningSecret(endpoint);

res = session.post(
    f"{BASE}/webhooks/endpoints",
    json={
        "url": "https://hooks.example.com/curobi",
        "events": ["subscription.cancelled", "subscription.payment_failed"],
    },
)
res.raise_for_status()
 
endpoint = res.json()
 
# The signing secret is in this response and in no other response, ever.
store_signing_secret(endpoint)

uri = URI("#{BASE}/webhooks/endpoints")
 
req = Net::HTTP::Post.new(uri)
req["Authorization"] = "Bearer #{ENV.fetch('CUROBI_API_KEY')}"
req["Content-Type"]  = "application/json"
req.body = JSON.dump(
  url: "https://hooks.example.com/curobi",
  events: %w[subscription.cancelled subscription.payment_failed]
)
 
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(req) }
raise res.body unless res.is_a?(Net::HTTPSuccess)
 
endpoint = JSON.parse(res.body)
 
# The signing secret is in this response and in no other response, ever.
store_signing_secret(endpoint)

import type { Route } from "./+types/settings.webhooks";
 
export async function action({ request }: Route.ActionArgs) {
  const form = await request.formData();
 
  const res = await fetch("https://app.curobi.com/api/admin/v1/webhooks/endpoints", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.CUROBI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      url: String(form.get("url")),
      events: form.getAll("events").map(String),
    }),
  });
 
  const endpoint = await res.json();
  if (!res.ok) return { error: endpoint.error.code };
 
  // Returned once. Write it to your secrets store here, not to the session and
  // certainly not back to the browser.
  await storeSigningSecret(endpoint);
 
  return { ok: true };
}

# Not a receiver — a debugging tool. Recompute the signature for a delivery you
# captured, and compare it with the v1= value the header carried.
SECRET='…'                     # the endpoint's signing secret
T=1755264000                   # the t= value from X-Curobi-Signature
BODY=$(cat delivery.json)      # the raw body, byte for byte, exactly as received
 
printf '%s.%s' "$T" "$BODY" \
  | openssl dgst -sha256 -hmac "$SECRET" -r \
  | cut -d ' ' -f 1

// Web Crypto — Deno, Bun, Cloudflare Workers, any edge runtime.
const encoder = new TextEncoder();
 
export async function verify(secret, header, rawBody, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  if (!Number.isFinite(t)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSeconds) return false;
 
  const key = await crypto.subtle.importKey(
    "raw",
    encoder.encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"],
  );
  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(`${t}.${rawBody}`));
  const expected = [...new Uint8Array(signature)]
    .map((byte) => byte.toString(16).padStart(2, "0"))
    .join("");
 
  return timingSafeEqual(expected, parts.v1 ?? "");
}
 
// Web Crypto has no timingSafeEqual, so compare in constant time by hand.
function timingSafeEqual(a, b) {
  if (a.length !== b.length) return false;
  let diff = 0;
  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
  return diff === 0;
}

import crypto from "node:crypto";
 
export function verify(secret, header, rawBody, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSeconds) return false;
 
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1 ?? "", "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hashlib
import hmac
import time
 
 
def verify(secret: str, header: str, raw_body: bytes, tolerance: int = 300) -> bool:
    parts = dict(part.split("=", 1) for part in header.split(","))
 
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
 
    if abs(int(time.time()) - t) > tolerance:
        return False
 
    expected = hmac.new(
        secret.encode(),
        f"{t}.".encode() + raw_body,  # the raw bytes, never a re-encoded dict
        hashlib.sha256,
    ).hexdigest()
 
    return hmac.compare_digest(expected, parts.get("v1", ""))

require "openssl"
 
def verify(secret, header, raw_body, tolerance = 300)
  parts = header.split(",").to_h { |part| part.split("=", 2) }
 
  t = Integer(parts["t"], exception: false)
  return false if t.nil?
  return false if (Time.now.to_i - t).abs > tolerance
 
  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{t}.#{raw_body}")
 
  # Constant-time, and safe on a length mismatch.
  OpenSSL.secure_compare(expected, parts["v1"].to_s)
end

// A resource route: no default export, so it answers POSTs and renders nothing.
import type { Route } from "./+types/webhooks.curobi";
import { verify } from "~/lib/curobi-webhooks.server";
 
export async function action({ request }: Route.ActionArgs) {
  // `request.text()` is the raw body. Never verify against a re-serialised
  // `request.json()` — your JSON encoding will not be ours, byte for byte.
  const rawBody = await request.text();
  const signature = request.headers.get("X-Curobi-Signature") ?? "";
 
  if (!verify(process.env.CUROBI_WEBHOOK_SECRET!, signature, rawBody)) {
    throw new Response("Invalid signature", { status: 401 });
  }
 
  const event = JSON.parse(rawBody);
 
  // Dedupe on event.id, then queue — you have 10 seconds to answer.
  await enqueueIfNew(event.id, event);
 
  return new Response(null, { status: 202 });
}