Webhooks

{
  "id": "evt_a1b2c3d4-...",
  "type": "verification.completed",
  "created_at": "2026-01-15T12:00:00.000Z",
  "schema_version": "2026-01-07",
  "publisher_id": "pub_...",
  "integration_id": "int_...",
  "session_id": "emb_sess_...",
  "test": false,
  "idempotency_key": "emb_sess_...:verification.completed",
  "data": { ... }
}

{
  "type": "verification.started",
  "data": {
    "status": "started",
    "expires_at": "2026-01-15T12:10:00.000Z"
  }
}

{
  "type": "verification.completed",
  "data": {
    "status": "completed",
    "result": {
      "verified": true,
      "level": "L1",
      "challenge_age": 25
    },
    "external_user_id": "user_123",
    "publisher_state": "abc123"
  }
}

{
  "type": "verification.failed",
  "data": {
    "status": "failed",
    "failure": {
      "code": "PROVIDER_REJECTED",
      "message": "Verification did not pass provider requirements"
    },
    "external_user_id": "user_123",
    "publisher_state": "abc123"
  }
}

{
  "type": "verification.expired",
  "data": {
    "status": "expired",
    "expires_at": "2026-01-15T12:10:00.000Z"
  }
}

import { verifyWebhookSignature } from '@emblemapp/sdk'

app.post('/webhook', express.raw({ type: '*/*' }), (req, res) => {
  const rawBody = req.body.toString('utf-8')
  const signature = req.headers['x-emblem-signature'] || ''
  const timestamp = req.headers['x-emblem-timestamp'] || ''

  const isValid = verifyWebhookSignature({
    signature,
    timestamp,
    rawBody,
    secret: process.env.EMBLEM_WEBHOOK_SECRET,
  })

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' })
  }

  const event = JSON.parse(rawBody)
  // Handle the event...
  res.json({ received: true })
})

import { createHmac, timingSafeEqual } from 'node:crypto'

function verifyWebhook(rawBody, signatureHeader, secret) {
  // Parse "t={unix_seconds},v1={hex_hmac}"
  const parts = {}
  for (const pair of signatureHeader.split(',')) {
    const [k, v] = pair.split('=', 2)
    parts[k] = v
  }

  const timestamp = parts.t
  const signature = parts.v1
  if (!timestamp || !signature) return false

  // Reject if too old (5-minute tolerance)
  const age = Math.abs(Math.floor(Date.now() / 1000) - parseInt(timestamp, 10))
  if (age > 300) return false

  // Compute expected signature
  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')

  // Constant-time comparison
  try {
    return timingSafeEqual(
      Buffer.from(signature, 'hex'),
      Buffer.from(expected, 'hex')
    )
  } catch {
    return false
  }
}

const processed = new Set() // Use a database in production

app.post('/webhook', express.raw({ type: '*/*' }), (req, res) => {
  // ... verify signature first ...

  const event = JSON.parse(req.body.toString('utf-8'))

  if (processed.has(event.idempotency_key)) {
    return res.json({ received: true }) // Already handled
  }

  processed.add(event.idempotency_key)
  handleEvent(event)
  res.json({ received: true })
})

import express from 'express'
import { verifyWebhookSignature } from '@emblemapp/sdk'

const app = express()

// In production, use Redis or a database with TTL-based expiry
const processed = new Set()

app.post('/webhook', express.raw({ type: '*/*' }), (req, res) => {
  const rawBody = req.body.toString('utf-8')
  const signature = req.headers['x-emblem-signature'] || ''
  const timestamp = req.headers['x-emblem-timestamp'] || ''

  // 1. Verify signature
  const isValid = verifyWebhookSignature({
    signature,
    timestamp,
    rawBody,
    secret: process.env.EMBLEM_WEBHOOK_SECRET,
  })

  if (!isValid) {
    console.error('Webhook signature verification failed')
    return res.status(401).json({ error: 'Invalid signature' })
  }

  // 2. Parse and deduplicate
  const event = JSON.parse(rawBody)

  if (processed.has(event.idempotency_key)) {
    return res.json({ received: true }) // Already handled
  }
  processed.add(event.idempotency_key)

  // 3. Route by event type
  switch (event.type) {
    case 'verification.started':
      console.log(
        `Session ${event.session_id} started, expires ${event.data.expires_at}`
      )
      break

    case 'verification.completed':
      const { verified, level } = event.data.result
      console.log(
        `Session ${event.session_id}: verified=${verified}, level=${level}`
      )
      // Grant access to the user
      break

    case 'verification.failed':
      console.log(
        `Session ${event.session_id} failed: ${event.data.failure.code}`
      )
      break

    case 'verification.cancelled':
      console.log(`Session ${event.session_id} cancelled by user`)
      break

    case 'verification.expired':
      console.log(`Session ${event.session_id} expired`)
      break
  }

  res.json({ received: true })
})