Merchant API

# 1 — mint an API key. Keep it on your server; it is shown once and never stored by us.
curl -sX POST https://privacyhood-backend-843fl.ondigitalocean.app/api-keys \
  -H 'content-type: application/json' \
  -d '{"label":"my-store"}'
# → {"keyId":"mk_…","apiKey":"phk_mk_….<hmac>","label":"my-store","createdAt":"…"}

export PRIVACYHOOD_API_KEY="phk_mk_….<hmac>"   # ← paste the apiKey from step 1

# 2 — create an invoice for 25 USDG, with a webhook.
#     NOTE: if the key is missing or empty this STILL returns 201 — and the invoice is orphaned,
#     meaning you can never list, void or receipt it. Always confirm the header is really set.
curl -sX POST https://privacyhood-backend-843fl.ondigitalocean.app/invoices \
  -H "authorization: Bearer $PRIVACYHOOD_API_KEY" \
  -H 'content-type: application/json' \
  -d '{
        "recipient": "0xYourPayoutAddress",
        "amount": "25",
        "ref": "ORDER-1042",
        "memo": "One large coffee",
        "webhookUrl": "https://yourstore.com/hooks/privacyhood"
      }'
# → {"invoiceId":"inv_…","manageToken":"…","webhookSecret":"whsec_…", …}
#   Store webhookSecret against your order NOW — it is per-invoice and shown only once.

# 3 — send the customer to checkout. Build this URL yourself; the API does not return one.
echo "https://www.privacyhood.org/pay?invoice=inv_…"

# 1 — a test key (note the tk_ id in the response)
curl -sX POST https://privacyhood-backend-843fl.ondigitalocean.app/api-keys \
  -H 'content-type: application/json' -d '{"mode":"test","label":"local dev"}'
export PRIVACYHOOD_TEST_KEY="phk_tk_….<hmac>"

# 2 — a test invoice, pointed at your webhook endpoint
INV=$(curl -sX POST https://privacyhood-backend-843fl.ondigitalocean.app/invoices \
  -H "authorization: Bearer $PRIVACYHOOD_TEST_KEY" -H 'content-type: application/json' \
  -d '{"recipient":"0xYourPayoutAddress","amount":"25","ref":"TEST-1","webhookUrl":"https://your.site/hook"}' \
  | grep -o '"invoiceId":"[^"]*"' | cut -d'"' -f4)

# 3 — settle it. Your endpoint receives a real signed invoice.paid webhook within the response.
curl -sX POST https://privacyhood-backend-843fl.ondigitalocean.app/invoices/$INV/simulate-pay \
  -H "authorization: Bearer $PRIVACYHOOD_TEST_KEY"
# → { "ok":true, "status":"paid", "test":true, "deliveredTx":"0x…",
#     "webhook":{ "delivered":true, "responseStatus":200 } }

POST https://yourstore.com/hooks/privacyhood
x-privacyhood-event: invoice.paid
x-privacyhood-signature: sha256=<hmac of the RAW body under THIS invoice's webhookSecret>
user-agent: PrivacyHooks-Webhooks/1

{
  "id": "evt_<random>",
  "event": "invoice.paid",
  "createdAt": "2026-08-07T19:56:19.198Z",
  "data": {
    "invoiceId": "inv_<uuid>",
    "ref": "ORDER-1042",
    "memo": "One large coffee",
    "amountBaseUnits": "25000000",
    "token": "USDG",
    "recipient": "0xYourPayoutAddress",
    "deliveredTx": "0x<delivery tx hash>"
  }
}

// IMPORTANT: the signing secret is PER INVOICE, not per account. Store the webhookSecret you got
// back from POST /invoices alongside your order, then look it up by data.invoiceId when the event
// arrives. A single global secret will fail to verify everything except the one invoice it came from.
import { createHmac, timingSafeEqual } from "node:crypto";

function signatureMatches(rawBody: Buffer, header: string, secret: string): boolean {
  const expected = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(header || "");
  // Compare lengths first — timingSafeEqual throws if they differ.
  return a.length === b.length && timingSafeEqual(a, b);
}

// Express — express.raw(), NOT express.json(). Re-serializing parsed JSON changes the bytes and the
// HMAC will never match.
app.post("/hooks/privacyhood", express.raw({ type: "application/json" }), async (req, res) => {
  let evt;
  try {
    evt = JSON.parse(req.body.toString("utf8"));
  } catch {
    return res.sendStatus(400);
  }

  // Look the secret up by invoice — you stored it when you created the invoice.
  const order = await db.orders.findByInvoiceId(evt?.data?.invoiceId);
  if (!order) return res.sendStatus(404);
  if (!signatureMatches(req.body, req.header("x-privacyhood-signature") || "", order.webhookSecret)) {
    return res.sendStatus(401);
  }

  // Delivery is at-least-once, so make this idempotent.
  if (evt.event === "invoice.paid" && !order.paidAt) {
    // Check the amount you expected — never fulfil on the event's word alone.
    if (evt.data.amountBaseUnits === order.amountBaseUnits) await fulfil(order.id);
  }
  res.sendStatus(200); // any 2xx stops the retries
});