Webhooks

{
  "id": "evt_…",
  "object": "event",
  "type": "user.created",
  "created_at": "2026-09-29T10:15:00.000Z",
  "environment_id": "…",
  "organization_id": null,
  "data": { "id": "…", "email": "ada@example.com" }
}

// app/api/webhooks/3een/route.ts
import { NextResponse } from 'next/server';
import { verifyWebhook, WebhookVerificationError } from '@3een/auth/nextjs';

export async function POST(request: Request) {
  // The raw body: the signature covers the exact bytes that were sent.
  const rawBody = await request.text();
  const secret = process.env.AUTH_WEBHOOK_SECRET; // whsec_…, server only
  if (!secret) return NextResponse.json({ error: 'Webhook secret not configured' }, { status: 500 });

  try {
    const event = verifyWebhook<{ id: string; email?: string }>(
      rawBody,
      request.headers.get('3een-Signature'),
      secret,
    );
    if (event.type === 'user.created') {
      // provision the user in your own database, keyed by event.data.id
    }
    return NextResponse.json({ received: true });
  } catch (error) {
    if (error instanceof WebhookVerificationError) {
      // Bad signature, or a timestamp outside the 5-minute window (a replay).
      return NextResponse.json({ error: error.message }, { status: 400 });
    }
    throw error;
  }
}