Webhooks

curl -s -X POST $HL/v1/webhooks -H "Authorization: Bearer $HK" \
  -H "content-type: application/json" \
  -d '{ "url": "https://example.com/hashlock", "events": ["swap.funded", "swap.settled"] }'

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const SECRET = process.env.HASHLOCK_WEBHOOK_SECRET!; // "whsec_…"
const app = express();

app.post('/hashlock', express.raw({ type: 'application/json' }), (req, res) => {
  const ts = req.header('x-hashlock-timestamp') ?? '';
  const sig = req.header('x-hashlock-signature') ?? '';
  const body = (req.body as Buffer).toString('utf8');

  const expected = 'sha256=' + createHmac('sha256', SECRET).update(`${ts}.${body}`).digest('hex');
  const ok = sig.length === expected.length && timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  // Replay protection: reject timestamps older than your own tolerance.
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.status(401).end();

  const event = JSON.parse(body);
  // handle event.type …
  res.status(204).end();
});