Webhooks

curl -X PATCH https://dolphy.chat/api/account/api-keys/dpy_live_abc12345/webhook \
  -H "Authorization: Bearer <firebase-id-token>" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-app.example.com/dolphy-webhook"}'
# → { "ok": true, "secret": "kK3X..." }   ← save this

{
  "id": "wh_FjkW3hQ_completed",
  "event": "video.completed",
  "created": 1730000000,
  "data": {
    "id": "FjkW3hQ",
    "status": "COMPLETED",
    "url": "https://firebasestorage.googleapis.com/...mp4",
    "credits_used": 18
  }
}

{
  "id": "wh_FjkW3hQ_failed",
  "event": "video.failed",
  "created": 1730000000,
  "data": {
    "id": "FjkW3hQ",
    "status": "FAILED",
    "reason": "Video expired upstream",
    "credits_used": 18
  }
}

import crypto from "crypto";

function verifyDolphySignature(
  rawBody: string,
  signatureHeader: string,
  secret: string,
): boolean {
  const m = signatureHeader.match(/t=(\d+),v1=([a-f0-9]+)/);
  if (!m) return false;
  const [, t, v1] = m;
  // Reject events older than 5 min to defend against replay
  if (Math.floor(Date.now() / 1000) - parseInt(t) > 300) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

import hmac, hashlib, time

def verify_dolphy_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    parts = dict(p.split("=") for p in signature_header.split(","))
    t = int(parts.get("t", "0"))
    v1 = parts.get("v1", "")
    if int(time.time()) - t > 300:  # reject > 5min old
        return False
    expected = hmac.new(secret.encode(), f"{t}.{raw_body.decode()}".encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(v1, expected)

curl -X PATCH https://dolphy.chat/api/account/api-keys/dpy_live_abc12345/webhook \
  -H "Authorization: Bearer <firebase-id-token>" \
  -H "Content-Type: application/json" \
  -d '{"regenerateSecret": true}'

curl -X PATCH .../webhook -d '{"url": null}'