@scoova/webhooks

Standalone webhooks client for the Scoova platform. CRUD for subscriptions plus a top-level verifyWebhookSignature helper for your server's webhook handler.

npm install @scoova/webhooks

Usage

import { WebhooksClient, verifyWebhookSignature } from '@scoova/webhooks';

const webhooks = new WebhooksClient({ apiKey: process.env.SCOOVA_API_KEY });

const hook = await webhooks.create({
  url: 'https://example.com/scoova',
  events: ['route.created', 'trip.arrived'],
});
// hook.secret is shown only here — store it.

const all = await webhooks.list();
await webhooks.delete(all[0].id);

Verifying deliveries

Each delivery carries:

• X-Scoova-Event — the event name (e.g. route.created)
• X-Scoova-Signature — sha256=<hex> HMAC-SHA256 of the raw body using your subscription's secret

const ok = await verifyWebhookSignature(
  rawBody,
  req.headers['x-scoova-signature'],
  process.env.SCOOVA_WEBHOOK_SECRET,
);
if (!ok) return res.status(401).end();

The helper uses crypto.subtle (Web Crypto), so the same build runs in modern browsers and Node 18+ with no polyfill. Comparison is constant-time.

Options

new WebhooksClient({
  apiKey: 'sk_live_...',           // or set SCOOVA_API_KEY; falls back to 'demo'
  baseUrl: 'https://api.scoo-va.info/v1',
  fetch: customFetch,              // optional, defaults to global fetch
});

License

Apache-2.0