Try-On API and Webhooks

curl https://withlooksy.gadget.app/v1/try-on \
  --request POST \
  --header "Authorization: Bearer $LOOKSY_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "productId": "gid://shopify/Product/1234567890",
    "variantId": "gid://shopify/ProductVariant/9876543210",
    "image": "data:image/jpeg;base64,<BASE64_IMAGE>"
  }'

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyLooksyWebhook(rawBody, secret, signature) {
  const expected = `sha256=${createHmac("sha256", secret)
    .update(rawBody, "utf8")
    .digest("hex")}`;
  const expectedBytes = Buffer.from(expected, "utf8");
  const receivedBytes = Buffer.from(signature || "", "utf8");

  return expectedBytes.length === receivedBytes.length
    && timingSafeEqual(expectedBytes, receivedBytes);
}