Webhooks

{
  "event": "order.diserahkan",
  "sent_at": "2026-10-02T09:30:00.000Z",
  "order": {
    "id": "ord_xxxxxxxxxxxxxxxxxxxx",
    "status": "diserahkan",
    "service": "pt-perorangan",
    "price_idr": 2900000,
    "sla_due_at": "2026-10-04T08:00:00.000Z",
    "deliverable": "Akta dan SK Kemenkumham terlampir: ...",
    "updated_at": "2026-10-02T09:30:00.000Z"
  }
}

X-Dampingin-Signature: t=1790500000,v1=5f2c...e9
v1 = hex( HMAC-SHA256( webhook_secret, t + "." + raw_body ) )

import { createHmac, timingSafeEqual } from "node:crypto";

/** header = X-Dampingin-Signature, rawBody = request body as received (before JSON.parse). */
export function verifyDampingin(rawBody: string, header: string | null, secret: string, toleranceSec = 300) {
  if (!header) return false;
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=") as [string, string]));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1 ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}

// Next.js route handler
export async function POST(req: Request) {
  const raw = await req.text();
  if (!verifyDampingin(raw, req.headers.get("x-dampingin-signature"), process.env.DAMPINGIN_WEBHOOK_SECRET!)) {
    return new Response("bad signature", { status: 401 });
  }
  const { event, order } = JSON.parse(raw);
  // Idempotent handling: the same event can arrive more than once.
  console.log(event, order.id, order.status);
  return new Response(null, { status: 204 });
}