Rails + PrintedSimply

# app/services/printed_simply.rb
class PrintedSimply
  BASE_URL = "https://portal.printedsimply.com/api/v1"

  def initialize(api_key = ENV["PRINTEDSIMPLY_API_KEY"])
    @api_key = api_key
  end

  def products
    get("/products")
  end

  def product(sku)
    get("/products/#{sku}")
  end

  def estimate(items:, shipping_method: "standard")
    post("/pricing/estimate", {
      items: items,
      shipping_method: shipping_method,
    })
  end

  # reference is your own order id. It is stamped on the order, and it makes
  # the Idempotency-Key: a retry of the same order returns the first result
  # instead of placing a second one.
  def create_order(reference:, items:, address_to:, shipping_method: "standard")
    post("/order", {
      reference: reference,
      items: items,
      address_to: address_to,
      shipping: { method: shipping_method },
    }, idempotency_key: "order-#{reference}")
  end

  def order(id)
    get("/order/#{id}")
  end

  private

  def headers
    { "x-api-key" => @api_key, "Content-Type" => "application/json" }
  end

  def get(path)
    HTTParty.get("#{BASE_URL}#{path}", headers: headers).parsed_response
  end

  def post(path, body, idempotency_key: nil)
    request_headers = headers
    request_headers = request_headers.merge("Idempotency-Key" => idempotency_key) if idempotency_key
    HTTParty.post("#{BASE_URL}#{path}", headers: request_headers, body: body.to_json).parsed_response
  end
end

# app/controllers/webhooks_controller.rb
class WebhooksController < ApplicationController
  skip_before_action :verify_authenticity_token, raise: false

  # Delivery is at-least-once: a retry or a redelivery sends the same event
  # again, with the same X-PS-Event-Id. Skip an id you have already handled.
  # In production, keep handled ids in your database under a unique index;
  # this set stands in for it.
  HANDLED = Set.new

  def printedsimply
    # The raw bytes, exactly as signed — not params.
    raw_body = request.raw_post
    signature = request.headers["X-PS-Signature-V2"]
    unless verify_webhook(raw_body, signature, ENV.fetch("PRINTEDSIMPLY_WEBHOOK_SECRET"))
      return head :unauthorized
    end

    event_id = request.headers["X-PS-Event-Id"].to_s
    return head :ok if HANDLED.include?(event_id)

    # Every delivery is { "id", "event", "timestamp", "data" }; the order is in data.
    event = JSON.parse(raw_body)
    order = event.fetch("data", {})
    case event["event"]
    when "order.shipped"
      Rails.logger.info "Shipped! Order #{order['order_id']}, tracking #{order["tracking_number"]}"
      # Update your database
    when "order.delivered"
      Rails.logger.info "Delivered! Order #{order['order_id']}"
    end
    # Answer 200 to events you do not handle too: anything else is a failed delivery.

    HANDLED.add(event_id)
    head :ok
  end

  private

  TOLERANCE_SECONDS = 300

  # header is the raw X-PS-Signature-V2 value, e.g. "t=1754222400,v1=abc123..."
  # During a secret rotation the header carries one v1 per live secret
  # ("t=...,v1=<new>,v1=<old>"), so collect them all and accept ANY match.
  # A missing header (nil) is refused like a malformed one.
  def verify_webhook(raw_body, header, secret)
    t = ""
    v1s = []
    header.to_s.split(",").each do |part|
      key, value = part.strip.split("=", 2)
      next if value.nil?

      if key == "t"
        t = value
      elsif key == "v1"
        v1s << value
      end
    end
    return false unless t.match?(/\A\d+\z/) && v1s.any?

    # Reject a captured request replayed outside the window. This check is the
    # reason to prefer V2 — a body-only signature never expires.
    return false if (Time.now.to_i - t.to_i).abs > TOLERANCE_SECONDS

    # The timestamp is signed along with the body, so it cannot be swapped out.
    expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{t}.#{raw_body}")
    v1s.any? { |v1| ActiveSupport::SecurityUtils.secure_compare(v1, expected) }
  end
end