Build on the 180 Sovereign Ecosystem.

const express = require('express');
const { constructWebhookEvent } = require('@workspace/identity-sdk');
const app = express();

// Preserve raw bytes specifically on webhook endpoint before express.json()
app.post('/api/webhooks/180-pay', express.raw({ type: '*/*' }), (req, res) => {
  const event = constructWebhookEvent(
    req.body.toString('utf8'),
    req.headers['x-180-signature'],
    process.env.ONE_EIGHTY_WEBHOOK_SECRET,
    req.headers['x-180-timestamp']
  );
  if (event.event === 'payment.captured') {
    fulfillOrder(event.data.orderId);
  }
  res.json({ received: true });
});

// 1. In-App WebView Bridge with OneEightyMobileChannel & OneEightyPaymentChannel
InAppWebView(
  initialUrlRequest: URLRequest(url: WebUri('https://profile.180core.cloud/auth/login?client_id=$clientId&redirect_uri=$redirectUri')),
  onWebViewCreated: (controller) {
    controller.addJavaScriptHandler(
      handlerName: 'OneEightyMobileChannel',
      callback: (args) => handleAuth(jsonDecode(args[0])),
    );
    controller.addJavaScriptHandler(
      handlerName: 'OneEightyPaymentChannel',
      callback: (args) => handlePayment(jsonDecode(args[0])),
    );
  },
)

// 2. Or launch Sovereign Checkout via url_launcher:
final uri = Uri.parse(
  'https://profile.180core.cloud/checkout?amount=499¤cy=INR&order_id=ord_12345&return_url=myapp://payment/callback'
);
await launchUrl(uri, mode: LaunchMode.inAppBrowserView);

import hmac, hashlib, time
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
SECRET = "whsec_live_..."

@app.post("/api/webhooks/180-pay")
async def handle_webhook(request: Request):
    raw_body = await request.body()
    ts = request.headers.get("x-180-timestamp")
    sig = request.headers.get("x-180-signature")

    # 5-min replay defense
    if abs(int(time.time()) - int(ts)) > 300:
        raise HTTPException(status_code=401, detail="Expired")

    expected = hmac.new(SECRET.encode(), f"{ts}.{raw_body.decode()}".encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        raise HTTPException(status_code=401, detail="Invalid signature")
    return { "received": True }