Webhooks

curl -X POST https://api.pickfu.com/v2/webhook-endpoints \
  -H "Authorization: Bearer sk_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.example.com/pickfu/webhooks",
    "enabledEvents": ["survey.completed", "order.paid"]
  }'

{
  "object": "webhook_endpoint",
  "id": "whk_01J9C2VZH8...",
  "url": "https://your-app.example.com/pickfu/webhooks",
  "enabledEvents": ["survey.completed", "order.paid"],
  "secret": "whsec_...",
  "createdAt": "2026-09-10T18:22:00.000Z",
  "updatedAt": "2026-09-10T18:22:00.000Z"
}

{
  "id": "evt_01J9C2VZH8...",
  "type": "survey.completed",
  "createdAt": "2026-09-10T18:25:00.000Z",
  "data": {
    "object": { /* full survey or order resource */ }
  }
}

X-PickFu-Signature: t=1725974400,v1=5d4b2c...

import crypto from "node:crypto";

function verifyPickFuSignature(header: string, rawBody: string, secret: string) {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.trim().split("="))
  );
  const t = parts["t"];
  const v1 = parts["v1"];
  if (!t || !v1) return false;

  const ageSeconds = Math.abs(Date.now() / 1000 - Number(t));
  if (ageSeconds > 5 * 60) return false;

  // Reject anything that isn't a 64-char hex digest before comparing —
  // timingSafeEqual throws on length mismatch, which would surface an
  // attacker-controlled header value as a request-triggered error.
  if (!/^[0-9a-f]{64}$/i.test(v1)) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}