Webhooks

curl https://www.opencharts.com/api/v1/webhooks \
  -H "Authorization: Bearer $OPENCHARTS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production events",
    "url": "https://example.com/hooks/opencharts",
    "events": ["video.completed", "video.failed", "song.completed", "research.completed"]
  }'

{
  "eventId": "0d5b2c9e-...",
  "eventVersion": "2026-02-24",
  "event": "video.completed",
  "occurredAt": "2026-07-22T14:03:11.000Z",
  "timestamp": "2026-07-22T14:03:11.000Z",
  "data": {
    "jobId": "vid_6870f3...",
    "status": "complete",
    "pollUrl": "https://www.opencharts.com/api/v1/jobs/vid_6870f3..."
  }
}

import crypto from "node:crypto";

export function verifyOpenChartsSignature(rawBody, signatureHeader, secret) {
  // Header format: "sha256=<hex>"
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
  return (
    signatureHeader?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected))
  );
}

// Express example: use the RAW body, not the parsed JSON.
app.post("/hooks/opencharts", express.raw({ type: "*/*" }), (req, res) => {
  const ok = verifyOpenChartsSignature(
    req.body.toString("utf8"),
    req.header("X-OpenCharts-Signature"),
    process.env.OPENCHARTS_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(401).end();
  const payload = JSON.parse(req.body.toString("utf8"));
  // handle payload.event / payload.data ...
  res.status(200).end();
});