Build on Stratos.

Events

• payment.authorizedA manual-capture payment is waiting to be captured.
• payment.settledA payment succeeded.
• payment.under_reviewA payment is held for a person to review.
• payment.failedA payment was declined, failed or voided.
• checkout.session.completedA hosted checkout was paid (its payment events arrive too).
• payment.refundedA payment was refunded in full or in part.
• transfer.createdA seller's share of a payment was recorded (a split or a transfer).
• transfer.paidA seller was paid their share.
• transfer.reversedA seller's share was reversed before it was paid.
• subscription.createdA customer subscribed to a plan.
• subscription.paidA subscription's period was charged.
• subscription.past_dueA subscription's charge did not go through; it will be tried again.
• subscription.cancelledA subscription ended, by request or after the last retry.
• invoice.sentAn invoice was sent to its customer with the pay link.
• invoice.payment_recordedA payment landed on an invoice, through the pay link or recorded by hand.
• invoice.paidAn invoice is paid in full.
• invoice.overdueAn invoice is a week past its due date and still open.
• invoice.voidedA sent invoice was voided.
• payout.createdA payout instruction was recorded.
• payout.paidA payout was confirmed as paid.
• payout.failedA payout did not go through.
• payout.returnedA paid payout came back from the receiving bank.

Headers

• Stratos-Signaturet=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" with your endpoint's secret>
• Stratos-EventThe event type, for example payment.settled.
• Stratos-DeliveryThe delivery id; the same id on every retry, so you can skip repeats.

Check the signature

const crypto = require("node:crypto");

// header: the Stratos-Signature header; rawBody: the body exactly as received (a string).
function verifyStratosSignature(header, rawBody, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.trim().split("=")));
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1, "hex");
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

module.exports = { verifyStratosSignature };