Webhooks & delivery

curl -X POST https://api.batchrouter.com/v1/batches \
  -H "Authorization: Bearer $BATCHROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: batch-2026-06-18-001" \
  -d '{
    "quote_id": "qlock_abc123",
    "items": [
      {"customer_item_id":"item-1","operation":"responses","model":"gpt-5.4-mini","input":{"messages":[{"role":"user","content":"Summarize: BatchRouter routes batch-AI workloads across providers."}]}}
    ],
    "webhook": {
      "url": "https://example.com/hooks/batchrouter",
      "secret": "a-long-random-shared-secret"
    }
  }'

curl -X PUT https://api.batchrouter.com/v1/auth/account/delivery-webhook \
  -H "Authorization: Bearer $BATCHROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/batchrouter",
    "secret": "a-long-random-shared-secret"
  }'

import express from "express";
import crypto from "node:crypto";

const SECRET = process.env.BATCHROUTER_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 5 * 60;
const app = express();

// Capture the RAW body — required for an accurate HMAC.
app.use(express.raw({ type: "application/json" }));

app.post("/hooks/batchrouter", (req, res) => {
  const signature = req.get("X-BatchRouter-Signature") ?? "";
  const timestamp = req.get("X-BatchRouter-Timestamp") ?? "";

  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!timestamp || !(age <= TOLERANCE_SECONDS)) {
    return res.status(401).send("stale timestamp");
  }

  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${timestamp}.`)
    .update(req.body) // req.body is a Buffer of the raw bytes
    .digest("base64url"); // base64url, no padding

  const sigBuf = Buffer.from(signature);
  const expBuf = Buffer.from(expected);
  if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
    return res.status(401).send("invalid signature");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  // ... handle event.type ("batch.completed", …) and event.batch (id, state, …)
  res.sendStatus(200);
});