Set Up Webhooks

curl -X POST https://api.sandbox.zexrail.com/v1/webhooks \
  -H "Authorization: Bearer sk_test_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/webhooks/zexrail",
    "events": ["settlement.completed", "negotiation.accepted"],
    "secret": "whsec_your_signing_secret"
  }'

const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(`sha256=${expected}`)
  );
}

app.post('/webhooks/zexrail', (req, res) => {
  const sig = req.headers['x-zexrail-signature'];
  if (!verifySignature(JSON.stringify(req.body), sig, SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  res.status(200).send('OK');
});