คู่มือการเชื่อมต่อนักพัฒนา (Developer Guide)

curl -X POST https://api.checkslips.com/v1/verify \
  -H "X-Tenant-ID: your-tenant-id" \
  -H "Authorization: Bearer your-api-key" \
  -F "image=@/path/to/slip.jpg"

const express = require('express');
const crypto = require('crypto');
const app = express();

// Use express.raw() to access the raw request body for signature verification
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const signingSecret = 'your-webhook-signing-secret';

  // Compute HMAC SHA256 signature
  const expectedSignature = crypto
    .createHmac('sha256', signingSecret)
    .update(req.body)
    .digest('hex');

  // Secure comparison
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );

  if (!isValid) {
    return res.status(401).send('Invalid webhook signature');
  }

  // Parse payload and process event
  const payload = JSON.parse(req.body.toString());
  console.log('Event Received:', payload.event);
  
  res.status(200).send('OK');
});