import express from "express";
import { LeapOCR } from "leapocr";

const app = express();

app.post(
  "/leapocr/webhooks",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const rawBody = req.body.toString("utf8");
    const signature = req.header("X-R2-Signature") ?? "";
    const secret = process.env.LEAPOCR_WEBHOOK_SECRET ?? "";

    if (!(await LeapOCR.verifyWebhookSignature(rawBody, signature, secret))) {
      res.status(401).send("Invalid signature");
      return;
    }

    const event = JSON.parse(rawBody);
    res.status(200).json({ received: true, eventType: event.event_type });
  },
);

import json
import os

from fastapi import FastAPI, Header, HTTPException, Request
from leapocr import LeapOCR

app = FastAPI()

@app.post("/leapocr/webhooks")
async def leapocr_webhook(
    request: Request,
    x_r2_signature: str | None = Header(default=None),
):
    raw_body = await request.body()
    secret = os.environ.get("LEAPOCR_WEBHOOK_SECRET", "")

    if not LeapOCR.verify_webhook_signature(raw_body, x_r2_signature or "", secret):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = json.loads(raw_body)
    return {"received": True, "eventType": event["event_type"]}

<?php

use LeapOCR\LeapOCR;

$rawBody = file_get_contents('php://input') ?: '';
$signature = $_SERVER['HTTP_X_R2_SIGNATURE'] ?? '';
$secret = (string) getenv('LEAPOCR_WEBHOOK_SECRET');

if (!LeapOCR::verifyWebhookSignature($rawBody, $signature, $secret)) {
    http_response_code(401);
    echo 'Invalid signature';
    exit;
}

$event = json_decode($rawBody, true, flags: JSON_THROW_ON_ERROR);
http_response_code(200);
echo json_encode(['received' => true, 'eventType' => $event['event_type']]);

package main

import (
    "encoding/json"
    "io"
    "net/http"
    "os"
    ocr "github.com/leapocr/leapocr-go"
)

func leapocrWebhook(w http.ResponseWriter, r *http.Request) {
    rawBody, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Invalid body", http.StatusBadRequest)
        return
    }

    signature := r.Header.Get("X-R2-Signature")
    secret := os.Getenv("LEAPOCR_WEBHOOK_SECRET")

    if !ocr.VerifyWebhookSignature(rawBody, signature, secret) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    var event map[string]any
    if err := json.Unmarshal(rawBody, &event); err != nil {
        http.Error(w, "Invalid JSON", http.StatusBadRequest)
        return
    }

    w.Header().Set("Content-Type", "application/json")
    _ = json.NewEncoder(w).Encode(map[string]any{
        "received":  true,
        "eventType": event["event_type"],
    })
}