Webhooks

{
  "event": "image.completed",
  "image_id": "img_01HSXYZ9Y5T8S5H0R9F3A2M7Q1",
  "status": "completed",
  "result": {
    "image_url": "https://cdn.proclubsstudio.com/partner/img_01HSXYZ9Y5T8S5H0R9F3A2M7Q1.png",
    "width": 1024,
    "height": 1280,
    "content_type": "image/png",
    "expires_at": "2026-05-21T11:30:12Z"
  },
  "usage": {
    "credits_used": 1
  },
  "metadata": {
    "partner_user_id": "user_789"
  },
  "timestamp": "2026-02-19T11:30:12Z"
}

{
  "event": "image.failed",
  "image_id": "img_01HSXYZ9Y5T8S5H0R9F3A2M7Q1",
  "status": "failed",
  "failure": {
    "code": "IMAGE_PROCESSING_FAILED",
    "message": "Unable to detect player in source image"
  },
  "metadata": {
    "partner_user_id": "user_789"
  },
  "timestamp": "2026-02-19T11:30:08Z"
}

import crypto from "node:crypto";

function verifyWebhookSignature(
  rawBody: string,
  signature: string,
  timestamp: string,
  webhookSecret: string
): boolean {
  // Reject if timestamp is older than 5 minutes
  const timestampAge = Math.abs(Date.now() / 1000 - parseInt(timestamp, 10));
  if (timestampAge > 300) {
    return false;
  }

  // Compute expected signature
  const payload = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac("sha256", webhookSecret)
    .update(payload)
    .digest("hex");

  const expectedSig = `sha256=${expected}`;

  // Constant-time comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSig)
  );
}

// Express middleware example
app.post("/webhooks/proclubsstudio", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.headers["x-proclubs-signature"] as string;
  const timestamp = req.headers["x-proclubs-timestamp"] as string;
  const event = req.headers["x-proclubs-event"] as string;

  const isValid = verifyWebhookSignature(
    req.body.toString(),
    signature,
    timestamp,
    process.env.WEBHOOK_SECRET!
  );

  if (!isValid) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const payload = JSON.parse(req.body.toString());

  switch (event) {
    case "image.completed":
      console.log("Image ready:", payload.result.image_url);
      break;
    case "image.failed":
      console.log("Image failed:", payload.failure.message);
      break;
  }

  res.status(200).json({ received: true });
});