Webhooks

curl -X POST "https://app.adyvance.com/_public/v1/orgs/org_…/webhooks" \
  -H "Authorization: Bearer $ADYVANCE_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/adyvance",
    "events": ["order.created", "order.status_changed", "payment.state_changed"],
    "description": "Accounting sync"
  }'

{
  "id": "evt_…",
  "type": "order.status_changed",
  "api_version": "2026-10-01",
  "org_id": "org_…",
  "store_id": "str_…",
  "occurred_at": "2026-11-05T09:20:03.000Z",
  "resource": { "type": "order", "id": "ord_…", "seq": 4 },
  "livemode": true,
  "data": {
    "object": { "id": "ord_…", "number": "1048", "status": "shipped", "…": "…" }
  }
}

POST /hooks/adyvance HTTP/1.1
Content-Type: application/json
User-Agent: Adyvance-Webhooks/1
Ady-Webhook-Id: evt_…
Ady-Webhook-Timestamp: 1793870403000
Ady-Signature: t=1793870403000,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd
Ady-Resource: order:ord_…;seq=4

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_MS = 5 * 60 * 1000;

/**
 * Checks an Adyvance webhook. `rawBody` must be the exact bytes received,
 * as a string, before any JSON parsing.
 */
export function verifyAdyvanceWebhook(rawBody, signatureHeader, secret) {
  let t = null;
  const v1 = [];
  for (const part of (signatureHeader ?? "").split(",")) {
    const [k, v] = part.split("=", 2).map((s) => s?.trim());
    if (k === "t") t = Number(v);
    if (k === "v1" && v) v1.push(v);
  }
  if (!t || v1.length === 0) return false;
  if (Math.abs(Date.now() - t) > TOLERANCE_MS) return false; // too old or from the future

  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  // During a secret rotation there are two v1 values: accept either.
  return v1.some((hex) => {
    const got = Buffer.from(hex, "hex");
    return got.length === expected.length && timingSafeEqual(got, expected);
  });
}

import express from "express";
import { verifyAdyvanceWebhook } from "./verify.js";

const app = express();
const seen = new Set(); // use your database in production

app.post("/hooks/adyvance", express.text({ type: "application/json" }), (req, res) => {
  const ok = verifyAdyvanceWebhook(
    req.body,
    req.get("Ady-Signature"),
    process.env.ADYVANCE_WEBHOOK_SECRET,
  );
  if (!ok) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  res.sendStatus(200); // answer first, then work

  if (seen.has(event.id)) return; // delivered before
  seen.add(event.id);
  queueWork(event); // your own background job
});

// Cloudflare Workers, Deno, Bun or any runtime with WebCrypto
async function verify(rawBody, header, secret) {
  const parts = Object.groupBy(header.split(","), (p) => p.split("=")[0]);
  const t = Number(parts.t?.[0]?.slice(2));
  const sigs = (parts.v1 ?? []).map((p) => p.slice(3));
  if (!t || !sigs.length || Math.abs(Date.now() - t) > 300_000) return false;

  const key = await crypto.subtle.importKey(
    "raw", new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" }, false, ["sign"],
  );
  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${t}.${rawBody}`));
  const hex = [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, "0")).join("");
  return sigs.some((s) => sameHex(s, hex));
}

// Constant-time compare, so the time taken says nothing about the secret.
function sameHex(a, b) {
  if (a.length !== b.length) return false;
  let diff = 0;
  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
  return diff === 0;
}