Webhooks

const res = await fetch("https://api.byteverseafrica.com/v1/webhook_endpoints", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.BYTEVERSE_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "url": "https://api.arewathreads.ng/webhooks/byteverse",
    "events": [
      "campaign.activated",
      "campaign.progress",
      "campaign.completed"
    ]
  }),
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://api.byteverseafrica.com/v1/webhook_endpoints",
    headers={"Authorization": f"Bearer {os.environ['BYTEVERSE_API_KEY']}"},
    json={
        "url": "https://api.arewathreads.ng/webhooks/byteverse",
        "events": ["campaign.activated", "campaign.progress", "campaign.completed"],
    },
    timeout=30,
)
data = res.json()

<?php
$ch = curl_init("https://api.byteverseafrica.com/v1/webhook_endpoints");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => ["Authorization: Bearer " . getenv("BYTEVERSE_API_KEY"), "Content-Type: application/json"],
  CURLOPT_POSTFIELDS => json_encode([
    "url" => "https://api.arewathreads.ng/webhooks/byteverse",
    "events" => ["campaign.activated", "campaign.progress", "campaign.completed"],
  ]),
]);
$data = json_decode(curl_exec($ch), true);

import hmac, hashlib, time

def verify_byteverse(raw_body: bytes, signature_header: str, secret: str, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in signature_header.split(","))
    t = int(parts.get("t", "0"))
    if not t or abs(time.time() - t) > tolerance:
        return False  # too old: possible replay
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

# Flask example
@app.post("/webhooks/byteverse")
def byteverse_webhook():
    if not verify_byteverse(request.get_data(), request.headers.get("ByteVerse-Signature", ""), os.environ["BYTEVERSE_WHSEC"]):
        return "bad signature", 400
    event = request.get_json()
    # 1) store event["id"] and skip if seen   2) enqueue work   3) answer fast
    return "", 200

<?php
function verify_byteverse(string $rawBody, string $header, string $secret, int $tolerance = 300): bool {
  $parts = [];
  foreach (explode(",", $header) as $p) { [$k, $v] = array_pad(explode("=", $p, 2), 2, ""); $parts[$k] = $v; }
  $t = (int)($parts["t"] ?? 0);
  if (!$t || abs(time() - $t) > $tolerance) return false;   // too old: possible replay
  $expected = hash_hmac("sha256", $t . "." . $rawBody, $secret);
  return hash_equals($expected, $parts["v1"] ?? "");
}

$raw = file_get_contents("php://input");
if (!verify_byteverse($raw, $_SERVER["HTTP_BYTEVERSE_SIGNATURE"] ?? "", getenv("BYTEVERSE_WHSEC"))) { http_response_code(400); exit("bad signature"); }
$event = json_decode($raw, true);
// 1) store $event["id"] and skip if seen   2) enqueue work   3) answer fast
http_response_code(200);