After a sale – deliver what they bought

import { verifyWebhook } from '@veto-protocol/checkout';

export async function POST(req: Request) {
  // 1. Read the RAW body – never JSON.parse → re-stringify before verifying.
  const raw = await req.text();
  const signature = req.headers.get('veto-signature'); // "t=…,v1=…"

  // 2. Verify it really came from Veto (positional args; returns { ok, reason? }).
  const result = verifyWebhook(raw, signature, process.env.VETO_WEBHOOK_SECRET!);
  if (!result.ok) {
    return new Response(`bad signature: ${result.reason}`, { status: 400 });
  }

  const event = JSON.parse(raw);

  // 3. Fulfill on order.settled (the rail confirmed the money is yours).
  if (event.type === 'order.settled') {
    const order = event.data.object;
    // ── fulfill here ────────────────────────────────────────────────
    //   PHYSICAL: createShipment({ to: { name: order.buyer.name,
    //                                    ...order.buyer.shipping_address },
    //                              lines: order.items, reference: order.id });
    //   DIGITAL:  const link = await mintDownloadUrl(order.items, order.receipt_id);
    //             await emailBuyer(order.buyer, link);   // or grant account access
    // ────────────────────────────────────────────────────────────────
  }

  // 4. Return 2xx fast (<10s) to ack. Anything else triggers a retry.
  return new Response('ok', { status: 200 });
}

import hmac, hashlib, time, json
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["VETO_WEBHOOK_SECRET"]  # your whsec_… from Sale notifications

@app.post("/webhooks/veto")
def veto_webhook():
    raw = request.get_data(as_text=True)              # the RAW body – verify these exact bytes
    header = request.headers.get("Veto-Signature", "")  # "t=…,v1=…"

    # Parse "t=<unix>,v1=<hex>" into t and the list of v1 signatures.
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t = parts.get("t")
    got = [v for k, v in (p.split("=", 1) for p in header.split(",")) if k == "v1"]
    if not t or not got:
        return "missing signature", 400

    # Reject replays: the timestamp must be within ±300s of now.
    if abs(int(time.time()) - int(t)) > 300:
        return "stale", 400

    # Recompute HMAC-SHA256(secret, "t.rawBody") and constant-time compare.
    expected = hmac.new(SECRET.encode(), f"{t}.{raw}".encode(), hashlib.sha256).hexdigest()
    if not any(hmac.compare_digest(expected, v) for v in got):
        return "bad signature", 400

    event = json.loads(raw)

    # Fulfill on order.settled (the money is yours).
    if event["type"] == "order.settled":
        order = event["data"]["object"]
        # ── fulfill here ────────────────────────────────────────────
        #   PHYSICAL: ship_it(to=order["buyer"], lines=order["items"])
        #   DIGITAL:  link = mint_download(order["items"], order["receipt_id"])
        #             email_buyer(order["buyer"], link)   # or grant access
        # ────────────────────────────────────────────────────────────
        pass

    return "ok", 200  # return 2xx fast (<10s) or Veto retries

curl "https://api.veto-ai.com/v1/orders?merchant_id=mrch_01J…&limit=50" \
  -H "Authorization: Bearer veto_test_8f2c…"

{
  "data": [
    {
      "id": "ord_01J…",
      "merchant_id": "mrch_01J…",
      "decision": "accept",
      "total": { "currency": "USD", "subtotal": "39.00", "tax": "0.00", "total": "39.00" },
      "rail_name": "x402",
      "settlement_ref": "0x…txHash…",
      "receipt_id": "rcpt_01J…",
      "created_at": "2026-06-24T12:00:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": null
}