웹훅 가이드

POST {등록한 웹훅 URL}
Content-Type: application/json
X-Saemol-Event:     entitlement.activated
X-Saemol-Timestamp: 1783219000
X-Saemol-Signature: hex(HMAC-SHA256(웹훅 서명 키, "{timestamp}.{body}"))

{
  "event": "entitlement.activated",
  "product_id": "…",
  "data": {
    "order_id": "…", "order_number": "MF-…", "entitlement_id": "…",
    "kind": "subscription", "plan_name": "Pro",
    "license_key": "MF-…", "api_key": "mfk_…", "buyer_id": "…"
  },
  "sent_at": "2026-07-07T…"
}

import { verifyWebhook, SaemolWebhookError } from '@saemol/sdk'

export async function POST(req: Request) {
  const rawBody = await req.text()

  let event
  try {
    event = verifyWebhook({
      headers: req.headers,
      rawBody,
      secret: process.env.SAEMOL_WEBHOOK_SECRET!,
    })
  } catch (err) {
    if (err instanceof SaemolWebhookError) return new Response(null, { status: 400 })
    throw err
  }

  switch (event.event) {
    case 'entitlement.activated':
      await provision(event.data.api_key ?? event.data.license_key)
      break
    case 'entitlement.revoked':
      await blockAccess(event.data)   // event.data.reason으로 구분
      break
  }
  return Response.json({ received: true })
}

import express from 'express'
import { verifyWebhook } from '@saemol/sdk'

app.post('/webhooks/saemol',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    try {
      const event = verifyWebhook({
        headers: req.headers,
        rawBody: req.body,               // Buffer 그대로
        secret: process.env.SAEMOL_WEBHOOK_SECRET!,
      })
      handle(event)
      res.json({ received: true })
    } catch {
      res.status(400).end()
    }
  })

import { createHmac, timingSafeEqual } from 'node:crypto'

const expected = createHmac('sha256', webhookSecret)
  .update(`${headers['x-saemol-timestamp']}.${rawBody}`)
  .digest('hex')

const valid =
  expected.length === signature.length &&
  timingSafeEqual(Buffer.from(expected), Buffer.from(signature)) &&
  Math.abs(Date.now() / 1000 - Number(headers['x-saemol-timestamp'])) <= 300