curl -X POST https://api.stableyard.fi/v2/webhooks \
  -H "Authorization: Bearer sy_secret_*" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourserver.com/hooks",
    "events": ["payment.settled", "payment.failed", "deposit.detected"]
  }'

{
  "id": "evt_abc123",
  "object": "event",
  "type": "payment.settled",
  "created": 1710671400,
  "livemode": true,
  "data": {
    "sessionId": "ses_xyz",
    "status": "settled",
    "amount": 5000000,
    "currency": "USDC",
    "settledAt": 1710671400
  },
  "requestId": "req_abc"
}

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}