任务回调

curl 'https://01router.com/api/v1/generations' \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "seedance-2.5",
  "input": {
    "prompt": "A red fox running through fresh snow, cinematic"
  },
  "callback_url": "https://your-app.com/webhooks/generation"
}'

import { createHmac, timingSafeEqual } from 'node:crypto';

// rawBody is the original request body, before JSON parsing.
const timestamp = request.headers.get('x-gateway-timestamp') ?? '';
const signature = request.headers.get('x-gateway-signature') ?? '';
const expected = 'sha256=' + createHmac('sha256', process.env.API_KEY)
  .update(timestamp + '.' + rawBody).digest('hex');
const received = Buffer.from(signature);
const signed = Buffer.from(expected);
const fresh = /^\d+$/.test(timestamp) &&
  Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
const valid = fresh && received.length === signed.length &&
  timingSafeEqual(received, signed);
if (!valid) throw new Error('Invalid callback signature');