# No API key: the token in the URL identifies the source.
# Sign the exact bytes you send, with the source's signing secret.
BODY='{"topic": "order/created", "customer": {"phone": "+14155551234", "first_name": "Sam"}}'
T=$(date +%s)
SIG=$(printf '%s' "$T.$BODY" | openssl dgst -sha256 -hmac "$IBUBBL_EVENT_SECRET" | awk '{print $NF}')

curl -X POST "https://api.ibubbl.com/v1/events/$IBUBBL_EVENT_SOURCE_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-iBubbl-Signature: t=$T,v1=$SIG" \
  --data-raw "$BODY"

import { createHmac } from "node:crypto";

// No API key: the token in the URL identifies the source.
const token = process.env.IBUBBL_EVENT_SOURCE_TOKEN;
const secret = process.env.IBUBBL_EVENT_SECRET ?? "";

// Serialize once, then sign and send that same string.
const body = JSON.stringify({
  topic: "order/created",
  customer: { phone: "+14155551234", first_name: "Sam" },
});
const t = Math.floor(Date.now() / 1000);
const v1 = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");

const res = await fetch(`https://api.ibubbl.com/v1/events/${token}`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-iBubbl-Signature": `t=${t},v1=${v1}`,
  },
  body,
  signal: AbortSignal.timeout(10_000),
});

const data = await res.json();
if (!res.ok) throw new Error(`${res.status} ${data.detail?.error}`);
console.log(data.runs_started);

import hashlib
import hmac
import json
import os
import time

import requests

# No API key: the token in the URL identifies the source.
TOKEN = os.environ["IBUBBL_EVENT_SOURCE_TOKEN"]
SECRET = os.environ["IBUBBL_EVENT_SECRET"]

# Serialize once, then sign and send those same bytes.
body = json.dumps({
    "topic": "order/created",
    "customer": {"phone": "+14155551234", "first_name": "Sam"},
}).encode()
t = str(int(time.time()))
v1 = hmac.new(SECRET.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()

res = requests.post(
    f"https://api.ibubbl.com/v1/events/{TOKEN}",
    headers={"Content-Type": "application/json", "X-iBubbl-Signature": f"t={t},v1={v1}"},
    data=body,
    timeout=10,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{res.status_code} {data['detail']['error']}")
print(data["runs_started"])

{
  "received": true,
  "runs_started": 1
}

{
  "detail": {
    "error": "invalid_signature",
    "message": "Signature verification failed."
  }
}