# Node webhook receiver (node:http)

A dependency-light receiver for Blockmetric webhooks (API Pro): reads the raw body, verifies
`Blockmetric-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, t + "." + body)>` with the SDK (constant-time, 300 s
tolerance, accepts the second `v1` during a secret rotation), answers `204` immediately and deduplicates on the event
id (deliveries are at-least-once and retried up to 6 times).

```bash
# from the repository root, once (until the SDK is on npm)
npx tsc -p sdk/typescript/tsconfig.json
cd examples/node-webhook-receiver && npm install

export BLOCKMETRIC_WEBHOOK_SECRET=whsec_…   # the endpoint's signing secret from /account/api
node server.mjs                          # http://localhost:3000/hook
```

## Test locally without exposing your machine

The CLI forwards live events (or, without API Pro, newly polled events) to a local URL and signs them exactly like
real webhooks with a local secret it prints:

```bash
npx blockmetric listen --forward-to http://localhost:3000/hook
# → "Webhook signing secret (local, for this session): whsec_…"  → use it as BLOCKMETRIC_WEBHOOK_SECRET

npx blockmetric webhooks trigger big_liquidation --forward-to http://localhost:3000/hook --secret whsec_…
```

Without the SDK, verification is ~20 lines of `node:crypto` (see the API docs, `/docs/api#webhooks`).