Webhooks

curl -X POST https://api.kitefrost.io/v1/projects/$PROJECT_ID/webhooks \
  -H "Authorization: Bearer sk_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhooks/kitefrost",
    "events": ["generation.completed", "generation.failed"],
    "description": "Production server"
  }'

{
  "id": "wh_01HZ...",
  "url": "https://yourapp.com/webhooks/kitefrost",
  "events": ["generation.completed", "generation.failed"],
  "description": "Production server",
  "secret": "whsec_abcdef1234567890...",
  "active": true,
  "created_at": "2026-05-19T10:00:00Z"
}

import hashlib, hmac, time

def verify_webhook(secret: str, timestamp: str, body: bytes, signature: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:
        return False
    signed_payload = f"{timestamp}.".encode() + body
    expected = hmac.new(secret.encode(), signed_payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)

import crypto from "crypto";

function verifyWebhook(secret: string, timestamp: string, body: Buffer, signature: string): boolean {
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const signedPayload = Buffer.concat([Buffer.from(`${timestamp}.`), body]);
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(signedPayload).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}