Webhooks Integration Guide

const express = require('express');
const crypto = require('crypto');
const app = express();

// IMPORTANT: Parse the raw request body to verify the signature accurately
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf.toString();
  }
}));

const WEBHOOK_SECRET = process.env.VTRYON_WEBHOOK_SECRET;

app.post('/webhooks/vtryon', (req, res) => {
  const signature = req.headers['x-vtryon-signature'];
  
  if (!signature) {
    return res.status(401).send('Missing signature header');
  }

  // Compute the expected HMAC signature
  const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET);
  const computedSignature = hmac.update(req.rawBody).digest('hex');

  // Compare signatures securely using constant-time comparison
  const isSignatureValid = crypto.timingSafeEqual(
    Buffer.from(signature, 'utf-8'),
    Buffer.from(computedSignature, 'utf-8')
  );

  if (!isSignatureValid) {
    return res.status(401).send('Signature verification failed');
  }

  // 1. Instantly acknowledge the webhook with a 200 OK
  res.status(200).json({ received: true });

  // 2. Process the event payload asynchronously in the background
  const event = req.body;
  
  if (event.event === 'generation.status_changed') {
    const { task_id, status, data } = event;
    console.log(`Task ${task_id} status updated to: ${status}`);

    // Trigger reactive UI updates (WebSockets, Server-Sent Events, etc.)
    switch (status) {
      case 'completed':
        // Update DB, send socket notification to user with data.result_url
        break;
      case 'failed':
        // Update DB, notify user of failure reasons: event.error.message
        break;
      default:
        // Update status in local database
        break;
    }
  }
});

app.listen(3000, () => console.log('Server is running on port 3000'));