Webhooks

import { BanataAuth } from "@banata-auth/sdk";
 
const banata = new BanataAuth({
  apiKey: "your-api-key",
  baseUrl: "https://auth.banata.dev",
});
 
// Create a webhook endpoint
const endpoint = await banata.webhooks.createEndpoint({
  url: "https://myapp.com/api/webhooks/banata",
  events: [
    "user.created",
    "user.updated",
    "session.created",
    "organization.created",
  ],
});
 
// Save this secret securely — you need it to verify signatures
console.log(endpoint.secret); // "whsec_abc123..."
 
// List all endpoints
const { data: endpoints } = await banata.webhooks.listEndpoints();
 
// Update an endpoint
await banata.webhooks.updateEndpoint({
  endpointId: endpoint.id,
  url: "https://myapp.com/api/webhooks/v2/banata",
  events: ["user.created", "user.deleted"],
});
 
// Delete an endpoint
await banata.webhooks.deleteEndpoint({
  endpointId: endpoint.id,
});

{
  "event": "user.created",
  "timestamp": "2025-01-15T10:30:00.000Z",
  "data": {
    "id": "usr_01HXYZ...",
    "email": "user@example.com",
    "name": "Jane Doe",
    "createdAt": "2025-01-15T10:30:00.000Z"
  }
}

t={timestamp},v1={hmac_hex}

import { BanataAuth } from "@banata-auth/sdk";
 
const banata = new BanataAuth("your-api-key");
 
export async function POST(request: Request) {
  const body = await request.text();
  const signature = request.headers.get("webhook-signature")!;
 
  try {
    const event = await banata.webhooks.constructEvent({
      payload: body,
      sigHeader: signature,
      secret: "whsec_your-endpoint-secret",
    });
 
    // event is verified and parsed — safe to use
    switch (event.event) {
      case "user.created":
        await handleUserCreated(event.data);
        break;
      case "session.created":
        await handleSessionCreated(event.data);
        break;
    }
 
    return new Response("OK", { status: 200 });
  } catch (error) {
    console.error("Webhook verification failed:", error);
    return new Response("Invalid signature", { status: 401 });
  }
}

async function verifyWebhookSignature(
  body: string,
  signatureHeader: string,
  secret: string
): Promise<boolean> {
  // 1. Parse the signature header
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((part) => {
      const [key, value] = part.split("=");
      return [key, value];
    })
  );
 
  const timestamp = parts.t;
  const expectedSignature = parts.v1;
 
  if (!timestamp || !expectedSignature) {
    return false;
  }
 
  // 2. Reject timestamps older than 5 minutes (replay protection)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return false;
  }
 
  // 3. Strip the whsec_ prefix from the secret
  const rawSecret = secret.startsWith("whsec_")
    ? secret.slice(6)
    : secret;
 
  // 4. Compute the HMAC-SHA256 signature
  const message = `${timestamp}.${body}`;
  const encoder = new TextEncoder();
 
  const key = await crypto.subtle.importKey(
    "raw",
    encoder.encode(rawSecret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"]
  );
 
  const signatureBuffer = await crypto.subtle.sign(
    "HMAC",
    key,
    encoder.encode(message)
  );
 
  const computedSignature = Array.from(new Uint8Array(signatureBuffer))
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
 
  // 5. Use timing-safe comparison
  return timingSafeEqual(computedSignature, expectedSignature);
}
 
function timingSafeEqual(a: string, b: string): boolean {
  if (a.length !== b.length) return false;
  let result = 0;
  for (let i = 0; i < a.length; i++) {
    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return result === 0;
}

// src/app/api/webhooks/banata/route.ts
import { BanataAuth } from "@banata-auth/sdk";
 
const banata = new BanataAuth("your-api-key");
const WEBHOOK_SECRET = process.env.BANATA_WEBHOOK_SECRET!;
 
export async function POST(request: Request) {
  const body = await request.text();
  const signature = request.headers.get("webhook-signature");
  const timestamp = request.headers.get("webhook-timestamp");
 
  if (!signature || !timestamp) {
    return new Response("Missing signature headers", { status: 400 });
  }
 
  // Verify the webhook signature
  let event;
  try {
    event = await banata.webhooks.constructEvent({
      payload: body,
      sigHeader: signature,
      secret: WEBHOOK_SECRET,
    });
  } catch (err) {
    console.error("Webhook signature verification failed:", err);
    return new Response("Invalid signature", { status: 401 });
  }
 
  // Process the event
  try {
    switch (event.event) {
      case "user.created":
        // Sync the new user to your CRM or analytics platform
        await syncUserToCRM(event.data);
        break;
 
      case "user.deleted":
        // Clean up user data in external systems
        await cleanupExternalData(event.data.id);
        break;
 
      case "organization.created":
        // Provision resources for the new organization
        await provisionOrgResources(event.data);
        break;
 
      case "session.created":
        // Track sign-in events for analytics
        await trackSignIn(event.data);
        break;
 
      default:
        console.log(`Unhandled event type: ${event.event}`);
    }
  } catch (err) {
    // Log the error but still return 200 to prevent unnecessary retries
    console.error(`Error processing ${event.event}:`, err);
  }
 
  return new Response("OK", { status: 200 });
}

# Start your Next.js dev server
npm run dev
 
# In another terminal, create a tunnel to port 3000
ngrok http 3000

https://abc123.ngrok.io/api/webhooks/banata