Webhooks

curl https://api.shopinn.co.ke/api/sendway/v1/webhooks \
  -H "Authorization: Bearer sw_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://myshop.co.ke/hooks/sendway",
    "events": ["parcel.delivered", "cod.settled"],
    "description": "Production"
  }'

{
  "id": "evt_e8d29b286126368b2edffe2b",
  "object": "event",
  "type": "parcel.delivered",
  "created": 1789553339,
  "data": {
    "parcel": {
      "id": "9f3a1c72-...",
      "parcel_number": "PCL-A1B2C3",
      "tracking_number": "SHP-8DD1D9",
      "status": "DELIVERED",
      "payment_status": "PAID",
      "total_fee": 350,
      "currency": "KES",
      "description": "Two dresses",
      "package_size": "S",
      "recipient_name": "Achieng Otieno",
      "pickup_run_id": "cbcb7d07-..."
    }
  }
}

// PHP
function sendway_verify(string $secret, string $body, string $header): bool {
    $parts = [];
    foreach (explode(',', $header) as $chunk) {
        [$k, $v] = array_pad(explode('=', trim($chunk), 2), 2, null);
        if ($v !== null) $parts[$k] = $v;
    }
    if (empty($parts['t']) || empty($parts['v1'])) return false;

    // Reject anything older than five minutes so a captured call
    // cannot be replayed at you later.
    if (abs(time() - (int) $parts['t']) > 300) return false;

    $expected = hash_hmac('sha256', $parts['t'] . '.' . $body, $secret);
    return hash_equals($expected, $parts['v1']);
}

// Node
const crypto = require('crypto')

function verify(secret, rawBody, header, toleranceSec = 300) {
  const parts = Object.fromEntries(
    header.split(',').map((kv) => kv.split('=').map((s) => s.trim()))
  )
  if (!parts.t || !parts.v1) return false
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(parts.t)) > toleranceSec) return false

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${parts.t}.${rawBody}`)
    .digest('hex')

  const a = Buffer.from(expected, 'hex')
  const b = Buffer.from(parts.v1, 'hex')
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}