Webhooks

Content-Type: application/json
User-Agent: MarketSDK-Webhooks/1
MarketSDK-Event-Id: evt_034XtPDs7UJ0TXzTsdaHZa
MarketSDK-Delivery-Id: whd_034XtPDs7UJ0TXzTsdaHZa
MarketSDK-Signature: t=1790000000,v1=5f2b...

{
  "id": "evt_034XtPDs7UJ0TXzTsdaHZa",
  "object": "event",
  "type": "order.completed",
  "api_version": "v1",
  "created": "2026-10-01T12:00:00.000Z",
  "livemode": false,
  "data": { "object": { "object": "order", "id": "ord_...", "state": "completed" } }
}

import { createHmac, timingSafeEqual } from "node:crypto";

// MarketSDK-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">
export function verifyMarketSDK(header, rawBody, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((part) => part.split("=", 2)));
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1, "hex");
  return given.length === expected.length && timingSafeEqual(given, expected);
}

// Express: keep the body raw until it is verified.
app.post("/marketsdk/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyMarketSDK(
    req.get("MarketSDK-Signature") ?? "",
    req.body.toString("utf8"),
    process.env.MARKETSDK_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(400).end();
  const event = JSON.parse(req.body.toString("utf8"));
  // Answer 2xx quickly, then do the work. The same event can arrive twice:
  // skip an event.id you have already handled.
  res.status(200).end();
  queue.add(event);
});