Webhooks

Webhooks are configured per product in the Admin Console (Settings → Webhooks) or via the API. You register an HTTPS endpoint and choose event types; Aiinak POSTs a JSON payload for each event.

Every delivery includes an X-Aiinak-Signature header: an HMAC-SHA256 of the raw body using your endpoint's signing secret. Reject any payload whose signature does not match.

import crypto from "node:crypto";

function verify(req, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(req.rawBody)
    .digest("hex");
  const given = req.get("X-Aiinak-Signature") ?? "";
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(given)
  );
}