Webhooks

{
  "id": "evt_1234567890",
  "type": "payment.captured",
  "created": "2024-01-15T10:30:00Z",
  "livemode": false,
  "data": {
    "object": {
      "id": "pay_8xM2nQ4vR7kL9pYz",
      "session_id": "sess_2xK9mN7vQ3pL8wYz",
      "amount": 4990,
      "currency": "USD",
      "status": "captured",
      "payment_method_type": "card",
      "card": {
        "brand": "visa",
        "last4": "4242"
      }
    }
  }
}

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// In your webhook handler
app.post('/webhooks/atlas', (req, res) => {
  const signature = req.headers['x-atlas-signature'];
  const payload = JSON.stringify(req.body);

  if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = req.body;

  switch (event.type) {
    case 'payment.captured':
      // Fulfill the order
      await fulfillOrder(event.data.object.session_id);
      break;
    case 'payment.failed':
      // Notify the customer
      await notifyPaymentFailed(event.data.object);
      break;
  }

  res.status(200).send('OK');
});