The full partner API surface.

curl https://halfpixel.app/api/intake/cly_ab12cd34ef56gh78 \
  -H 'Authorization: Bearer hp_partner_<your-key>'

{
  "id": "cly_ab12cd34ef56gh78",
  "status": "completed",
  "assetId": "cly_root9z8x7y6w5v",
  "shareUrl": "https://halfpixel.app/api/share/cly_root9z8x7y6w5v",
  "formats": ["png", "svg"],
  "createdAt": "2026-08-22T12:34:56.789Z",
  "updatedAt": "2026-08-22T12:34:57.012Z",
  "brief": {
    "brandName": "Acme Studio",
    "logoUrl": "https://acme.com/logo.svg",
    "palette": ["#1a2b3c", "#dfe6ef", "#f25c54"],
    "voice": "Bold sans-serif typographic-leaning visuals.",
    "targetChannels": ["instagram_square", "instagram_story"]
  },
  "artifacts": [
    {
      "versionId": "cly_root9z8x7y6w5v",
      "createdAt": "2026-08-22T12:34:57.012Z",
      "status": "shipped",
      "previewUrl": "https://halfpixel.app/api/share/cly_root9z8x7y6w5v"
    },
    {
      "versionId": "cly_itera1b2c3d4e5f",
      "createdAt": "2026-08-22T12:51:09.443Z",
      "status": "iterating",
      "previewUrl": "https://halfpixel.app/api/share/cly_itera1b2c3d4e5f"
    }
  ]
}

import { createHmac, timingSafeEqual } from 'node:crypto';

const SECRET = process.env.INTAKE_CALLBACK_SIGNING_SECRET; // operator-supplied; >=32 chars

export function verifyIntakeWebhook(headerValue, rawBody) {
  if (!headerValue || !rawBody || !SECRET) return false;

  const parts = Object.fromEntries(
    headerValue.split(',').map((kv) => {
      const i = kv.indexOf('=');
      return [kv.slice(0, i).trim(), kv.slice(i + 1).trim()];
    }),
  );
  const t = parts.t;
  const v1 = parts.v1;
  if (!t || !v1) return false;

  // Reject timestamps more than 5 minutes off to blunt replay attacks.
  const skew = Math.abs(Math.floor(Date.now() / 1000) - Number(t));
  if (!Number.isFinite(skew) || skew > 300) return false;

  const expected = createHmac('sha256', SECRET)
    .update(`${t}.${rawBody}`)
    .digest('hex');

  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(v1, 'hex');
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

import express from 'express';
import { verifyIntakeWebhook } from './verify-intake-webhook';

const app = express();

app.post('/halfpixel/callback', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-Halfpixel-Signature') ?? '';
  if (!verifyIntakeWebhook(header, req.body.toString('utf8'))) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  // ...parse req.body as JSON and ack
  res.status(200).json({ ok: true });
});