Verification

app.post("/webhook", (req, res) => {
  const payload = req.body.toString();
  const signature = req.headers["x-hook0-signature"];
  const secret = process.env.WEBHOOK_SECRET;

  if (verifyWebhookSignature(payload, signature, secret, req.headers)) {
    const event = JSON.parse(payload);

    switch (event.eventType) {
      case "acceptance.payment_session.authorization_succeeded":
        // Funds held - ready to capture after fulfillment
        break;
      case "acceptance.payment_session.capture_succeeded":
        // Payment complete - update order status
        break;
      case "acceptance.payment_session.refund_succeeded":
        // Refund complete - notify customer
        break;
      case "acceptance.disbursement.succeeded":
        // Disbursement settled - update records
        break;
    }

    res.status(200).send("OK");
    return;
  }

  res.status(400).send("Invalid signature");
});