curl -X POST https://api.elebne.ai/api/v1/dev/webhooks/endpoints \
  -H "Authorization: Bearer sk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "X-Idempotency-Key: webhook-setup-$(date +%s)" \
  -d '{
    "url": "https://your-server.com/webhooks/elebne",
    "events": ["payment.confirmed", "order.new"]
  }'

const response = await fetch('https://api.elebne.ai/api/v1/dev/webhooks/endpoints', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_test_YOUR_KEY',
    'Content-Type': 'application/json',
    'X-Idempotency-Key': `webhook-setup-${Date.now()}`,
  },
  body: JSON.stringify({
    url: 'https://your-server.com/webhooks/elebne',
    events: ['payment.confirmed', 'order.new'],
  }),
});

const data = await response.json();
console.log(data);

import requests
import time

response = requests.post(
    'https://api.elebne.ai/api/v1/dev/webhooks/endpoints',
    headers={
        'Authorization': 'Bearer sk_test_YOUR_KEY',
        'Content-Type': 'application/json',
        'X-Idempotency-Key': f'webhook-setup-{int(time.time())}',
    },
    json={
        'url': 'https://your-server.com/webhooks/elebne',
        'events': ['payment.confirmed', 'order.new'],
    },
)

print(response.json())

const crypto = require('crypto');

function verifyWebhook(payload, signature, timestamp, secret) {
  const message = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');
  const received = signature.replace('sha256=', '');

  // Timing-safe comparison to prevent timing attacks
  if (expected.length !== received.length) return false;
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(received)
  );
}

// Express.js example
app.post('/webhooks/elebne', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-elebne-signature'];
  const timestamp = req.headers['x-elebne-timestamp'];

  if (!verifyWebhook(req.body.toString(), signature, timestamp, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  // Process the event...

  res.status(200).send('OK');
});

import hmac
import hashlib
from flask import Flask, request

app = Flask(__name__)

def verify_webhook(payload, signature, timestamp, secret):
    message = f"{timestamp}.{payload}"
    expected = hmac.new(
        secret.encode(), message.encode(), hashlib.sha256
    ).hexdigest()
    received = signature.replace("sha256=", "")
    return hmac.compare_digest(expected, received)

@app.route('/webhooks/elebne', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Elebne-Signature')
    timestamp = request.headers.get('X-Elebne-Timestamp')

    if not verify_webhook(request.data.decode(), signature, timestamp, WEBHOOK_SECRET):
        return 'Invalid signature', 401

    event = request.get_json()
    # Process the event...

    return 'OK', 200

function verifyWebhook(string $payload, string $signature, string $timestamp, string $secret): bool
{
    $message = "{$timestamp}.{$payload}";
    $expected = hash_hmac('sha256', $message, $secret);
    $received = str_replace('sha256=', '', $signature);

    return hash_equals($expected, $received);
}

// Usage
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_ELEBNE_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_ELEBNE_TIMESTAMP'] ?? '';

if (!verifyWebhook($payload, $signature, $timestamp, $webhookSecret)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);
// Process the event...

http_response_code(200);
echo 'OK';