Recipes: Webhooks & events

import express from 'express';
import { verifyWebhook } from '@sly_ai/sdk';

const app = express();

app.post('/webhooks/sly',
  express.raw({ type: '*/*' }),    // critical — raw body required
  (req, res) => {
    let event;
    try {
      event = verifyWebhook(
        req.body,
        req.headers['x-sly-signature'] as string,
        process.env.SLY_WEBHOOK_SECRET!,
      );
    } catch (e) {
      return res.status(400).end();
    }

    processEvent(event).catch(console.error);   // fire-and-forget
    res.status(202).end();                       // ack fast
  }
);

import { Hono } from 'hono';
import { verifyWebhook } from '@sly_ai/sdk';

const app = new Hono();
app.post('/webhooks/sly', async (c) => {
  const rawBody = await c.req.arrayBuffer();
  const signature = c.req.header('x-sly-signature') ?? '';

  try {
    const event = verifyWebhook(Buffer.from(rawBody), signature, process.env.SLY_WEBHOOK_SECRET!);
    queueEvent(event);
    return c.json({ received: true }, 202);
  } catch {
    return c.json({ error: 'invalid signature' }, 400);
  }
});

import hashlib
import hmac
import time
import json
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ['SLY_WEBHOOK_SECRET']

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split('=', 1) for p in header.split(','))
    timestamp = int(parts['t'])
    signature = parts['v1']

    if abs(time.time() - timestamp) > 300:   # 5-min replay window
        return False

    expected = hmac.new(
        secret.encode(),
        f'{timestamp}.{raw_body.decode()}'.encode(),
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

@app.route('/webhooks/sly', methods=['POST'])
def webhook():
    raw = request.get_data()    # raw bytes, NOT request.json
    sig = request.headers.get('X-Sly-Signature', '')
    if not verify(raw, sig, SECRET):
        abort(400)

    event = json.loads(raw)
    queue_event(event)
    return '', 202

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "io"
    "net/http"
    "os"
    "strconv"
    "strings"
    "time"
)

func verify(rawBody []byte, header, secret string) bool {
    parts := map[string]string{}
    for _, p := range strings.Split(header, ",") {
        kv := strings.SplitN(p, "=", 2)
        if len(kv) == 2 {
            parts[kv[0]] = kv[1]
        }
    }
    ts, err := strconv.ParseInt(parts["t"], 10, 64)
    if err != nil || time.Now().Unix()-ts > 300 {
        return false
    }
    mac := hmac.New(sha256.New, []byte(secret))
    fmt.Fprintf(mac, "%d.%s", ts, rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(parts["v1"]))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    raw, _ := io.ReadAll(r.Body)
    sig := r.Header.Get("X-Sly-Signature")
    secret := os.Getenv("SLY_WEBHOOK_SECRET")
    if !verify(raw, sig, secret) {
        http.Error(w, "invalid", http.StatusBadRequest)
        return
    }
    // queue event for async processing
    w.WriteHeader(http.StatusAccepted)
}

// In-memory LRU (simple case)
const seen = new LRU({ max: 10_000, ttl: 48 * 60 * 60 * 1000 });   // 48h TTL

async function handleEvent(event) {
  const eventId = event.id;
  if (seen.has(eventId)) return;
  seen.set(eventId, true);
  await processEvent(event);
}

// Postgres
const { rowCount } = await db.query(
  'INSERT INTO processed_events(event_id, at) VALUES ($1, NOW()) ON CONFLICT DO NOTHING',
  [event.id],
);
if (rowCount === 0) return;   // already processed
await processEvent(event);

curl -X POST https://api.getsly.ai/v1/webhooks \
  -H "Authorization: Bearer pk_live_..." \
  -d '{
    "url": "https://hooks.example.com/sly",
    "events": ["transfer.*", "settlement.*", "ap2.mandate.executed"]
  }'

# List failed deliveries
curl "https://api.getsly.ai/v1/webhooks/wh_.../deliveries?status=failed" \
  -H "Authorization: Bearer pk_live_..."

# Replay one
curl -X POST https://api.getsly.ai/v1/webhooks/wh_.../deliveries/del_.../replay \
  -H "Authorization: Bearer pk_live_..."

curl -X POST https://api.getsly.ai/v1/webhooks/wh_.../replay \
  -H "Authorization: Bearer pk_live_..." \
  -d '{
    "since": "2026-04-22T00:00:00Z",
    "until": "2026-04-23T00:00:00Z",
    "only_failed": true
  }'

# Fires a webhook.test event to your endpoint with valid signature
curl -X POST https://api.getsly.ai/v1/webhooks/wh_.../test \
  -H "Authorization: Bearer pk_live_..."

# Start your local server
npm run dev     # listens on 127.0.0.1:3000

# In another terminal
ngrok http 3000
# → https://abc123.ngrok-free.app

cloudflared tunnel --url http://localhost:3000
# → https://foo-bar-baz.trycloudflare.com

# Resume
curl -X POST https://api.getsly.ai/v1/webhooks/wh_.../resume \
  -H "Authorization: Bearer pk_live_..."

# Then bulk-replay events that piled up while paused
curl -X POST https://api.getsly.ai/v1/webhooks/wh_.../replay \
  -H "Authorization: Bearer pk_live_..." \
  -d '{ "since": "2026-04-22T14:00:00Z" }'