Webhooks overview

POST /your-webhook HTTP/1.1
Content-Type: application/json
X-Prudra-Signature: sha256=abc123...
X-Prudra-Timestamp: 1714472400

{
  "type":    "payment.received",
  "eventId": "evt_clx1abc123",
  "payload": { ... }
}

# 1. Register a webhook endpoint
curl -X POST https://api.prudra.dev/webhooks \
  -H "Authorization: Bearer prv_test_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url":    "https://your-server.com/webhooks/prudra",
    "events": ["payment.received", "vault.sealed", "deposit.success"]
  }'

# Response includes your webhook secret — save it
# { "id": "wh_clx1abc123", "secret": "whsec_...", ... }

// 2. Verify and handle in your server
import { verifyWebhook } from '@prudra/webhooks';

app.post('/webhooks/prudra', express.raw({ type: '*/*' }), (req, res) => {
  res.sendStatus(200);  // Always respond 200 quickly

  const isValid = verifyWebhook({
    payload:   req.body as Buffer,
    signature: req.headers['x-prudra-signature'] as string,
    timestamp: req.headers['x-prudra-timestamp'] as string,
    secret:    process.env.PRUDRA_WEBHOOK_SECRET!,
  });

  if (!isValid) return;
  const event = JSON.parse((req.body as Buffer).toString());
  // Handle event...
});