Integrate in 5 Minutes

// Handle Retake webhooks with signature verification
// app/api/webhooks/retake/route.ts
import { NextRequest, NextResponse } from 'next/server';
import crypto from 'crypto';

// Verify webhook signature
function verifySignature(payload: string, signature: string, secret: string): boolean {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(payload).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

export async function POST(request: NextRequest) {
  const body = await request.text();
  const signature = request.headers.get('X-Webhook-Signature');
  
  // Verify signature if you configured a webhook secret in dashboard
  if (process.env.RETAKE_WEBHOOK_SECRET && signature) {
    if (!verifySignature(body, signature, process.env.RETAKE_WEBHOOK_SECRET)) {
      return NextResponse.json({ error: 'Invalid signature' }, { status: 401 });
    }
  }
  
  const payload = JSON.parse(body);
  // Payload structure: { event, timestamp, data: { cartId, sessionId, ... } }
  
  switch (payload.event) {
    case 'cart.abandoned':
      // Fired when no customerEmail provided - send email yourself
      const customer = await db.customers.findBySession(payload.data.sessionId);
      await sendRecoveryEmail({ to: customer.email, cartItems: payload.data.items });
      break;
      
    case 'email.sent':
      // Fired after Retake successfully sends recovery email
      await analytics.track('recovery_email_sent', payload.data);
      break;
      
    case 'cart.recovered':
      // Fired when ORDER_COMPLETE received after recovery email was sent
      await analytics.track('cart_recovered', { revenue: payload.data.total });
      break;
  }
  
  return NextResponse.json({ received: true });
}