Webhooks & Postbacks

Copyexport const createWebhookSignature = async (secret: string, body: any) => {
  if (!secret) {
    throw new Error("A secret must be provided to create a webhook signature.");
  }
 
  const keyData = new TextEncoder().encode(secret);
  const messageData = new TextEncoder().encode(JSON.stringify(body));
 
  const cryptoKey = await crypto.subtle.importKey(
    "raw",
    keyData,
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"],
  );

Copy  const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
  const signatureArray = Array.from(new Uint8Array(signature));
  const hexSignature = signatureArray
    .map((byte) => byte.toString(16).padStart(2, "0"))
    .join("");
 
  return hexSignature;
};

Copyconst signature = await createWebhookSignature(
  this.postback.secret,
  transformedPayload,
);
 
const response = await qstash.publishJSON({
  callback: callbackUrl.href,
  failureCallback: callbackUrl.href,
  url: this.postback.url,
  body: transformedPayload,
  headers: {
    "Dub-Signature": signature,
    "Upstash-Hide-Headers": "true",
  },
});

Copyexport interface PostbackPayload {
  eventId: string;
  event: PostbackTrigger;
  createdAt: string;
  data: unknown;
}
 
export abstract class PostbackAdapter {
  protected eventTransformers = new PostbackEventTransformers();
 
  constructor(protected postback: Postback) {
    this.registerEventTransformers();
  }
 
  protected abstract registerEventTransformers(): void;
 

Copyasync execute(payload: PostbackPayload) {
  const transformedPayload = this.eventTransformers.transform(payload);
 
  if (!transformedPayload) {
    return;
  }
 

Copyconst searchParams = {
  postbackId: this.postback.id,
  eventId: payload.eventId,
  event: payload.event,
};
 
const callbackUrl = buildCallbackUrl(
  `${APP_DOMAIN_WITH_NGROK}/api/postbacks/callback`,
  searchParams,
);
 

Copyconst signature = await createWebhookSignature(
  this.postback.secret,
  transformedPayload,
);
 
const response = await qstash.publishJSON({
  callback: callbackUrl.href,
  failureCallback: callbackUrl.href,
  url: this.postback.url,
  body: transformedPayload,
  headers: {
    "Dub-Signature": signature,
    "Upstash-Hide-Headers": "true",
  },
});

Copy  if (!response.messageId) {
    console.error("Failed to publish postback event to QStash", response);
  }
 
  if (process.env.NODE_ENV === "development") {
    console.debug("Published postback event to QStash", {
      ...response,
      payload: transformedPayload,
    });
  }
}

Copy// GET /api/partner-profile/postbacks
export const GET = withPartnerProfile(
  async ({ partner }) => {
    const postbacks = await prisma.postback.findMany({
      where: {
        partnerId: partner.id,
      },
      orderBy: {
        createdAt: "desc",
      },
    });
 
    return NextResponse.json(z.array(postbackSchema).parse(postbacks));
  },
  {
    requiredPermission: "postbacks.read",
    featureFlag: "postbacks",
  },
);

Copy// POST /api/partner-profile/postbacks
export const POST = withPartnerProfile(
  async ({ partner, req }) => {
    const { name, url, triggers } = createPostbackInputSchema.parse(
      await parseRequestBody(req),
    );
 
    const postbackCount = await prisma.postback.count({
      where: {
        partnerId: partner.id,
      },
    });
 
    if (postbackCount >= MAX_POSTBACKS) {
      throw new DubApiError({
        code: "exceeded_limit",
        message: `Maximum number of postbacks (${MAX_POSTBACKS}) reached.`,
      });
    }
 
    const secret = createToken({
      prefix: POSTBACK_SECRET_PREFIX,
      length: POSTBACK_SECRET_LENGTH,
    });
 
    const postback = await prisma.postback.create({
      data: {
        id: createId({ prefix: "pb_" }),
        partnerId: partner.id,
        name,
        url,
        secret,
        triggers,
        receiver: identifyPostbackChannel(url),
      },
    });
 
    return NextResponse.json(createPostbackOutputSchema.parse(postback), {
      status: 201,
    });
  },
  {
    requiredPermission: "postbacks.write",
    featureFlag: "postbacks",
  },
);

Copy// POST /api/partner-profile/postbacks/[postbackId]/rotate-secret
export const POST = withPartnerProfile(
  async ({ partner, params }) => {
    const { postbackId } = params;
 
    await getPostbackOrThrow({
      postbackId,
      partnerId: partner.id,
    });
 
    const secret = createToken({
      prefix: POSTBACK_SECRET_PREFIX,
      length: POSTBACK_SECRET_LENGTH,
    });
 
    await prisma.postback.update({
      where: {
        id: postbackId,
      },
      data: {
        secret,
      },
    });
 
    return NextResponse.json({ secret });
  },
  {
    requiredPermission: "postbacks.write",
    featureFlag: "postbacks",
  },
);

Copy// POST /api/partner-profile/postbacks/[postbackId]/send-test
export const POST = withPartnerProfile(
  async ({ partner, params, req }) => {
    const { postbackId } = params;
 
    const { event } = sendTestPostbackInputSchema.parse(
      await parseRequestBody(req),
    );
 
    const postback = await getPostbackOrThrow({
      postbackId,
      partnerId: partner.id,
    });
 
    const triggers = postback.triggers as string[];
 
    if (!triggers.includes(event)) {
      throw new DubApiError({
        code: "bad_request",
        message: "The selected event is not configured for this postback.",
      });
    }
 
    await sendPartnerPostback({
      partnerId: partner.id,
      event,
      data: samplePayloads[event],
      skipEnrichment: true,
    });
 
    return NextResponse.json({});
  },
  {
    requiredPermission: "postbacks.write",
    featureFlag: "postbacks",
  },
);

Copyconst {
  data: postbacks,
  error,
  isLoading,
  mutate,
} = useSWR<PostbackProps[]>("/api/partner-profile/postbacks", fetcher, {
  keepPreviousData: true,
});
 
const { openPostbackSecretModal, PostbackSecretModal } =
  usePostbackSecretModal();
 
const { openAddPostbackModal, AddEditPostbackModal } =
  useAddEditPostbackModal(() => mutate(), openPostbackSecretModal);
 
return (
  <>
    <PageContent
      title="Postbacks"
      titleInfo={{
        title:
          "Receive HTTP requests when events like leads, sales, or commissions occur in your partner programs.",
        href: "https://d.to/postbacks",
      }}
      controls={<AddPostbackButton onClick={openAddPostbackModal} />}
    >
      <PageWidthWrapper>
        <div className="grid gap-5">
          <div className="animate-fade-in">
            {isLoading ? (
              <div className="grid grid-cols-1 gap-3">
                {Array.from({ length: 3 }).map((_, idx) => (
                  <PostbackPlaceholder key={idx} />
                ))}
              </div>
            ) : error ? (
              <div className="flex flex-col items-center gap-4 rounded-xl border border-neutral-200 py-10">
                <EmptyStateBlock
                  icon={AlertCircle}
                  title="Failed to load postbacks"
                  description={
                    error instanceof Error
                      ? error.message
                      : "Something went wrong. Please try again."
                  }
                >
                  <button
                    type="button"
                    onClick={() => mutate()}
                    className="flex h-8 items-center justify-center gap-2 rounded-md border border-neutral-200 bg-white px-4 text-sm font-medium text-neutral-700 transition-colors hover:bg-neutral-50"
                  >
                    Try again
                  </button>
                </EmptyStateBlock>
              </div>
            ) : postbacks && postbacks.length > 0 ? (
              <div className="grid grid-cols-1 gap-3">
                {postbacks.map((postback) => (
                  <PostbackCard key={postback.id} {...postback} />
                ))}
              </div>
            ) : (
              <div className="flex flex-col items-center gap-4 rounded-xl border border-neutral-200 py-10">
                <EmptyState
                  icon={Webhook}
                  title="You haven't set up any postbacks yet."
                  description="Postbacks allow you to receive HTTP requests when events like leads, sales, or commissions occur in your partner programs."
                  learnMore="https://d.to/postbacks"
                />
              </div>
            )}

Copyexport default function PostbackDetailPage() {
  const router = useRouter();
  const { postbackId } = useParams();
  const [openPopover, setOpenPopover] = useState(false);
 
  const {
    data: postback,
    error,
    isLoading,
    mutate,
  } = useSWR<PostbackProps>(
    postbackId ? `/api/partner-profile/postbacks/${postbackId}` : null,
    fetcher,
  );
 
  const {
    data: events,
    error: eventsError,
    isLoading: isEventsLoading,
  } = useSWR<PostbackEventProps[]>(
    postbackId ? `/api/partner-profile/postbacks/${postbackId}/events` : null,
    fetcher,
    { keepPreviousData: true },
  );
 
  const { postbackEventDetailsSheet, openWithEvent } =
    usePostbackEventDetailsSheet();
 
  const { openPostbackSecretModal, PostbackSecretModal } =
    usePostbackSecretModal();
 
  const { openEditPostbackModal, AddEditPostbackModal } =
    useAddEditPostbackModal(() => mutate(), openPostbackSecretModal);
 
  if (Boolean(error && (error as { status?: number }).status === 404)) {
    redirect("/profile/postbacks");
  }

Copyexport function usePostbackSecretModal() {
  const [state, setState] = useState<{ show: boolean; secret: string }>({
    show: false,
    secret: "",
  });
 
  function openPostbackSecretModal(secret: string) {
    setState({ show: true, secret });
  }
 
  function closePostbackSecretModal() {
    setState({ show: false, secret: "" });
  }
 
  return {
    openPostbackSecretModal,
    closePostbackSecretModal,
    // Return an element (rendered as `{PostbackSecretModal}`) rather than a
    // per-render component type, which would remount the modal – and reset its
    // state – on every parent render
    PostbackSecretModal: (
      <PostbackSecretModal
        showModal={state.show}
        setShowModal={(show) => {
          const next = typeof show === "function" ? show(state.show) : show;
          if (!next) closePostbackSecretModal();
        }}
        secret={state.secret}
      />
    ),
    isPostbackSecretModalOpen: state.show,
  };
}

Copyfunction PostbackSecretModal({
  showModal,
  setShowModal,
  secret,
}: PostbackSecretModalProps) {
  const [copied, copyToClipboard] = useCopyToClipboard();
 
  return (
    <Modal
      showModal={showModal}
      setShowModal={setShowModal}
      className="max-w-md"
    >
      <div className="space-y-2 border-b border-neutral-200 px-4 py-4 sm:px-6">
        <h3 className="text-lg font-medium">Signing secret</h3>
        <p className="text-sm text-neutral-500">
          Copy it and store it somewhere safe. You will need it to verify
          postback signatures.
        </p>
      </div>
 
      <div className="flex flex-col space-y-4 bg-neutral-50 px-4 py-8 sm:px-6">
        <div className="flex flex-col gap-1">
          <h2 className="text-sm font-medium text-neutral-800">
            Signing secret
          </h2>
          <div className="flex items-center justify-between gap-2 rounded-md border border-neutral-200 bg-white p-2">
            <p className="truncate font-mono text-sm text-neutral-500">
              {secret}
            </p>
            <button
              onClick={(e) => {
                e.stopPropagation();
                toast.promise(copyToClipboard(secret), {
                  success: "Secret copied to clipboard!",
                });
              }}
              type="button"
              className="flex h-7 shrink-0 items-center gap-2 rounded-md border border-neutral-200 bg-white px-2 py-1 text-xs font-medium text-neutral-900 hover:bg-neutral-50"
            >
              {copied ? (
                <Tick className="h-3.5 w-3.5" />
              ) : (
                <Copy className="h-3.5 w-3.5" />
              )}
              {copied ? "Copied" : "Copy"}
            </button>
          </div>
        </div>
 
        <Button
          text="Done"
          variant="secondary"
          onClick={() => setShowModal(false)}
          className="w-full"
        />
      </div>
    </Modal>
  );
}

Copyconst searchParamsSchema = z.object({
  webhookId: z.string(),
  eventId: z.string(),
  event: z.enum(WEBHOOK_TRIGGERS),
  failed: z.literal("true").optional(),
});
 
// POST /api/webhooks/callback – listen to webhooks status from QStash
export const POST = async (req: Request) => {
  const rawBody = await req.text();
  await verifyQstashSignature({ req, rawBody });
 
  const { url, status, body, sourceBody, sourceMessageId } =
    webhookCallbackSchema.parse(JSON.parse(rawBody));
 
  const {
    webhookId,
    eventId,
    event,
    failed: deliveryFailed, // failed after all the retries
  } = searchParamsSchema.parse(getSearchParams(req.url));
 

Copyexport const POST = async (req: Request) => {
  const rawBody = await req.text();
 
  await verifyQstashSignature({
    req,
    rawBody,
  });
 
  const { status, url, sourceMessageId, body, sourceBody, retried } =
    postbackCallbackBodySchema.parse(JSON.parse(rawBody));
 
  const { postbackId, eventId, event } = postbackCallbackParamsSchema.parse(
    getSearchParams(req.url),
  );

Copyconst webhook = await prisma.webhook.findUnique({
  where: {
    id: webhookId,
  },
});
 
if (!webhook) {
  console.error("Webhook not found", { webhookId });
  return new Response("Webhook not found");
}
 
const request = Buffer.from(sourceBody, "base64").toString("utf-8");
const response = Buffer.from(body, "base64").toString("utf-8");
const isFailed = status >= 400 || status === -1;
 

Copyconst tbResponse = await recordPostbackEvent({
  event_id: eventId,
  postback_id: postbackId,
  message_id: sourceMessageId,
  event,
  url,
  response_status: status === -1 ? 503 : status,
  request_body: request,
  response_body: response,
  retry_attempt: retried,
});
 
if (tbResponse.successful_rows === 0) {
  return logAndRespond(
    `Failed to record event ${eventId} for postback ${postbackId}.`,
    {
      status: 400,
    },
  );
}
…
const tbResponse = await recordPostbackEvent({
  event_id: eventId,
  postback_id: postbackId,
  message_id: sourceMessageId,
  event,
  url,
  response_status: status === -1 ? 503 : status,
  request_body: request,
  response_body: response,
  retry_attempt: retried,
});
 
if (tbResponse.successful_rows === 0) {
  return logAndRespond(
    `Failed to record event ${eventId} for postback ${postbackId}.`,
    {
      status: 400,
    },
  );
}

Copyawait Promise.allSettled([
  // Record the webhook event
  recordWebhookEvent({
    url,
    event,
    event_id: eventId,
    http_status: status === -1 ? 503 : status,
    webhook_id: webhookId,
    request_body: request,
    response_body: response,
    message_id: sourceMessageId,
  }),
 
  // Handle the webhook delivery failure if it's the last retry
  ...(isFailed ? [handleWebhookFailure(webhookId)] : []),
 
  // Only reset if there were previous failures
  ...(webhook.consecutiveFailures > 0 && !isFailed
    ? [resetWebhookFailureCount(webhookId)]
    : []),
 
  // Handle payout events
  ...(event === "payout.confirmed"
    ? [
        handleExternalPayoutEvent({
          webhook,
          payload: JSON.parse(request),
          status: deliveryFailed
            ? "failure"
            : isFailed
              ? "temporary_failure"
              : "success",
        }),
      ]
    : []),
]);

Copyimport { withAxiom } from "@/lib/axiom/server";
import { webhookPayloadSchema } from "@/lib/webhook/schemas";
import { timingSafeCompare } from "@/lib/webhook/timing-safe-compare";
import crypto from "crypto";
import { leadCreated } from "./lead-created";
import { saleCreated } from "./sale-created";
 
// POST /api/dub/webhook - receive webhooks for Dub
export const POST = withAxiom(async (req: Request) => {
  const body = await req.json();
  const { event, data } = webhookPayloadSchema.parse(body);
 
  const webhookSignature = req.headers.get("Dub-Signature");
 
  if (!webhookSignature) {
    return new Response("No signature provided", { status: 401 });
  }
 
  const computedSignature = crypto
    .createHmac("sha256", `${process.env.DUB_WEBHOOK_SECRET}`)
    .update(JSON.stringify(body))
    .digest("hex");
 
  if (!timingSafeCompare(webhookSignature, computedSignature)) {
    return new Response("Invalid signature", { status: 400 });
  }

Copy  let response = "OK";
 
  switch (event) {
    case "lead.created": // new signup via referral link (lead event)
      response = await leadCreated(data);
      break;
    case "sale.created": // new sale via referral link (sale event)
      response = await saleCreated(data);
      break;
  }
 
  return new Response(response);
});

Copyconst r2ObjectCreatedWebhookBodySchema = z.object({
  notification: r2ObjectCreatedNotificationSchema,
});
 
function verifyWorkerSecret(req: Request) {
  const webhookSecret = assertEnv("CLOUDFLARE_WORKER_WEBHOOK_SECRET");
 
  const auth = req.headers.get("authorization") || "";
  const token = auth.startsWith("Bearer ") ? auth.slice("Bearer ".length) : "";
 
  return timingSafeCompare(token, webhookSecret);
}
 
// POST /api/cloudflare/webhook/r2-object-created
// Called by the Cloudflare queue consumer Worker (thin forwarder).
export async function POST(req: Request) {
  try {
    if (!verifyWorkerSecret(req)) {
      return NextResponse.json(
        {
          error: "Unauthorized",
        },
        {
          status: 401,
        },
      );
    }

Copyexport async function verifySignature({
  event,
  headers,
}: {
  event: string; // raw event data as string
  headers: Headers;
}) {
  const transmissionId = headers.get("paypal-transmission-id");
  const transmissionSig = headers.get("paypal-transmission-sig");
  const timeStamp = headers.get("paypal-transmission-time");
  const certUrl = headers.get("paypal-cert-url");
 
  if (!transmissionId || !transmissionSig || !timeStamp || !certUrl) {
    console.error(
      "[PayPal] Missing required headers for signature verification",
    );
    return false;
  }
 
  if (!isValidPayPalCertUrl(certUrl)) {
    console.error(`[PayPal] Rejected non-PayPal certificate URL: ${certUrl}`);
    return false;
  }
 
  const certPem = await downloadAndCache(certUrl);
 
  if (!certPem) {
    console.error("[PayPal] Failed to download or cache PayPal certificate");
    return false;
  }
 
  const crc = parseInt("0x" + crc32(event).toString("hex"));
  const message = `${transmissionId}|${timeStamp}|${paypalEnv.PAYPAL_WEBHOOK_ID}|${crc}`;
  const signatureBuffer = Buffer.from(transmissionSig, "base64");
 
  const verifier = crypto.createVerify("SHA256");
  verifier.update(message);
 
  return verifier.verify(certPem, new Uint8Array(signatureBuffer));
}