@delopay/sdk 0.9.0 → 0.10.0

package/README.md

@@ -167,24 +167,26 @@ const gateways = await delopay.shops.gateways.list(merchantId, shop.shop_id);
 
 ### Webhook verification
 
+Delopay signs each outgoing webhook with HMAC-SHA512 over the raw request body and delivers the hex-encoded digest in the `X-Webhook-Signature-512` header. Use `express.raw()` (not `express.json()`) so the bytes reach the verifier unchanged.
+
 ```typescript
+import express from 'express';
 import { Delopay } from '@delopay/sdk';
 
-// In your Express handler:
-app.post('/webhooks/delopay', express.raw({ type: 'application/json' }), (req, res) => {
-  const signature = req.headers['delopay-signature'] as string;
+app.post('/webhooks/delopay', express.raw({ type: 'application/json' }), async (req, res) => {
+  const signature = req.header('x-webhook-signature-512') ?? '';
   const secret = process.env.DELOPAY_WEBHOOK_SECRET!;
 
   let event;
   try {
-    event = Delopay.webhooks.verify(req.body.toString(), signature, secret);
-  } catch (err) {
+    event = await Delopay.webhooks.verify(req.body, signature, secret);
+  } catch {
     return res.status(400).send('Invalid signature');
   }
 
   switch (event.type) {
     case 'payment_succeeded':
-      // fulfill order
+      // fulfil order
       break;
     case 'payment_failed':
       // notify customer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delopay/sdk",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Official Delopay TypeScript SDK",
   "type": "module",
   "sideEffects": false,