# Reditus Webhooks

Reditus (getreditus.com) sends a webhook when a partnership is accepted or a referral, advocate, lead or reward is created. Each request is signed: the `X-Signature` header holds the hex HMAC-SHA256 of the **raw request body**, keyed with your webhook secret.

## When to Use This Skill

* How do I receive Reditus webhooks?
* How do I verify the Reditus `X-Signature` header?
* Why does my Reditus webhook signature verification fail?
* How do I handle `reward.created` or `lead.created` events?
* Which HTTP method does Reditus use? (Not documented: accept any)

## Verification (core)

The header is the bare lowercase hex digest: no prefix, no list, and only the body is signed (no timestamp or id, so there is no replay window to check). The key is the secret's UTF-8 bytes, used as-is.

```javascript
const crypto = require('crypto');

function verifyReditusSignature(rawBody, signature, secret = process.env.REDITUS_WEBHOOK_SECRET) {
  if (!secret || typeof signature !== 'string') return false;
  if (!/^[0-9a-fA-F]{64}$/.test(signature)) return false;     // validate before decoding

  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest(); // rawBody: Buffer
  const received = Buffer.from(signature.toLowerCase(), 'hex');
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

```

* Sign the **raw body bytes** exactly as received. Never `JSON.parse`/`JSON.stringify` first, and never decode and re-encode to a string.
* Hex is compared case-insensitively. Missing or empty header, malformed value or mismatch: `401`.
* Express: `express.raw({ type: '*/*' })`. Next.js: `await request.arrayBuffer()`. FastAPI: `await request.body()`. Python: `hmac.compare_digest` on bytes.
* **The HTTP method is not documented.** Accept GET, POST, PUT, PATCH and DELETE on the route and verify every one. A request with no body is verified over zero bytes, then acknowledged with `200`.
* **Hookdeck:** Hookdeck's Reditus source verifies the signature (HMAC SHA-256, `x-signature`, hex). It pre-selects POST without managing the method, so allow any other method Reditus uses on the source.

> **For complete handlers with tests**, see [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/reditus-webhooks/examples/express/), [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/reditus-webhooks/examples/nextjs/), [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/reditus-webhooks/examples/fastapi/).

## Event Types

Dispatch on the top-level `event_type`; `url`, `created_at` (a date) and `data` sit beside it.

| `event_type` | Fires when |
| --- | --- |
| `partnership.accepted` | An affiliate partnership is accepted |
| `referral.created` | A referral is created (affiliate program) |
| `advocate.created` | An advocate is created (referral program) |
| `lead.created` | A lead is created |
| `reward.created` | A reward is generated |

Treat every field of the parsed body as untrusted: check types before reading into `data`. Log event types you don't handle and return `200`.

## Environment Variables

```bash
REDITUS_WEBHOOK_SECRET=your_reditus_webhook_secret

```

Reditus's docs don't say where the webhook secret is shown or how it is set.

## Delivery

Reditus's docs say nothing about retries, timeouts or the expected response. Return `2xx` quickly and make handling idempotent (see `webhook-handler-patterns`).

## Local Development

```bash
npx hookdeck-cli listen 3000 reditus --path /webhooks/reditus

```

No account required. Use the printed URL as the endpoint in Reditus.

## Resources

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/reditus-webhooks/references/overview.md) - Events and payload shape
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/reditus-webhooks/references/setup.md) - Endpoint, secret and method notes
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/reditus-webhooks/references/verification.md) - Signature details, gotchas, debugging
* [examples/](https://github.com/hookdeck/webhook-skills/tree/main/skills/reditus-webhooks/examples/) - Runnable Express, Next.js and FastAPI handlers with tests