Webhooks

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "type": "invoice.approved",
  "environment": "sandbox",
  "timestamp": "2026-04-30T11:10:05.000Z",
  "data": {
    "invoiceId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "invoiceNumber": "INV-2026-001",
    "status": "accepted",
    "jurisdiction": "NG",
    "authorityReference": "NRS-REF-001",
    "submittedAt": "2026-04-30T11:10:05.000Z"
  }
}

import express from 'express';
import { verifyWebhook } from '@useyona/einvoice-js/webhooks';
 
const app = express();
 
app.post('/webhooks/yona', express.json(), (req, res) => {
  try {
    const event = verifyWebhook(
      req.body,
      req.headers,
      process.env.WEBHOOK_SECRET!,
    );
 
    switch (event.type) {
      case 'invoice.approved':
        handleApproved(event.data);
        break;
      case 'invoice.rejected':
        handleRejected(event.data);
        break;
      case 'invoice.submission_failed':
        handleFailed(event.data);
        break;
    }
 
    res.status(200).json({ received: true });
  } catch (err) {
    res.status(400).json({ error: 'Invalid signature' });
  }
});

import express from 'express';
import crypto from 'crypto';
 
const app = express();
 
app.post('/webhooks/yona', express.json(), (req, res) => {
  const signature = req.headers['x-webhook-signature'] as string;
  const timestamp = req.headers['x-webhook-timestamp'] as string;
 
  if (!signature || !timestamp) {
    return res.status(400).json({ error: 'Missing signature headers' });
  }
 
  // Replay protection: reject timestamps older than 5 minutes
  const age = Math.abs(Math.floor(Date.now() / 1000) - parseInt(timestamp));
  if (age > 300) {
    return res.status(400).json({ error: 'Timestamp too old' });
  }
 
  // Backend signs only the `data` field
  const signedPayload = `${timestamp}.${JSON.stringify(req.body.data)}`;
  const expected = `sha256=${crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET!)
    .update(signedPayload)
    .digest('hex')}`;
 
  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(400).json({ error: 'Invalid signature' });
  }
 
  // Signature valid — process event
  const { type, data, environment } = req.body;
 
  switch (type) {
    case 'invoice.approved':
      handleApproved(data);
      break;
    case 'invoice.rejected':
      handleRejected(data);
      break;
    case 'invoice.submission_failed':
      handleFailed(data);
      break;
  }
 
  res.status(200).json({ received: true });
});