Troubleshooting guide

curl https://portal.printedsimply.com/api/v1/products \
-H "x-api-key: ps_test_YOUR_KEY_HERE"

# Equivalent — the same credential as a Bearer token:
# -H "Authorization: Bearer ps_test_YOUR_KEY_HERE"

# Common mistake — a header name we do not read:
# -H "api-key: ps_test_..."                ← WRONG

async function fetchWithRetry(url: string, options: RequestInit, maxRetries = 3) {
for (let attempt = 0; attempt <= maxRetries; attempt++) {
  const response = await fetch(url, options);

  if (response.status === 429) {
    // Retry-After is in seconds, on both kinds of 429. (X-RateLimit-Reset is
    // a Unix timestamp in milliseconds, not seconds.)
    const retryAfter = Number(response.headers.get("Retry-After"));
    const waitMs = retryAfter > 0
      ? retryAfter * 1000
      : Math.pow(2, attempt) * 1000 + Math.random() * 1000;

    console.log(`Rate limited. Retrying in ${Math.round(waitMs / 1000)}s...`);
    await new Promise((resolve) => setTimeout(resolve, waitMs));
    continue;
  }

  return response;
}

throw new Error("Max retries exceeded");
}

import crypto from "crypto";
import express from "express";

const TOLERANCE_SECONDS = 300;

// header is the raw value of X-PS-Signature-V2, e.g. "t=1754222400,v1=abc123..."
// During a secret rotation the header carries one v1 per live secret
// ("t=...,v1=<new>,v1=<old>"), so collect them all and accept ANY match.
// A missing header (undefined or null) is refused like a malformed one.
function verifyWebhook(rawBody: string, header: string | null | undefined, secret: string): boolean {
  let t: string | null = null;
  const v1s: string[] = [];
  for (const part of (header || '').split(',')) {
    const i = part.indexOf('=');
    if (i <= 0) continue;
    const key = part.slice(0, i).trim();
    const value = part.slice(i + 1).trim();
    if (key === 't') t = value;
    else if (key === 'v1') v1s.push(value);
  }
  if (!/^\d+$/.test(t || '') || v1s.length === 0) return false;
  if (!v1s.every((v) => /^[0-9a-f]+$/i.test(v))) return false;

  // Reject a captured request replayed outside the window. This check is the
  // reason to prefer V2 — a body-only signature never expires.
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(t));
  if (age > TOLERANCE_SECONDS) return false;

  // The timestamp is signed along with the body, so it cannot be swapped out.
  const expected = crypto
    .createHmac('sha256', secret)
    .update(t + '.' + rawBody)
    .digest('hex');
  // timingSafeEqual requires equal-length buffers
  return v1s.some(
    (v) =>
      v.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(v), Buffer.from(expected))
  );
}

// Register this route BEFORE app.use(express.json()): the signature covers the
// raw bytes, and a JSON parser that runs first leaves an object behind.
app.post("/webhooks/printedsimply", express.raw({ type: "application/json" }), (req, res) => {
  const rawBody = Buffer.isBuffer(req.body) ? req.body.toString("utf8") : "";
  if (!verifyWebhook(rawBody, req.get("X-PS-Signature-V2"), process.env.PRINTEDSIMPLY_WEBHOOK_SECRET!)) {
    res.status(401).send("Invalid signature");
    return;
  }

  // Every delivery is { id, event, timestamp, data }; the order is in data.
  // Skip an X-PS-Event-Id you have already handled: delivery is at-least-once.
  const event = JSON.parse(rawBody);
  console.log(event.event, event.data.order_id);
  res.sendStatus(200);
});

curl -X POST https://portal.printedsimply.com/api/v1/artwork/validate \
-H "Content-Type: application/json" \
-H "x-api-key: ps_test_YOUR_KEY" \
-d '{
  "file_url": "https://example.com/design.png",
  "product_type": "sticker-die-cut",
  "width_px": 900,
  "height_px": 900,
  "dpi": 300,
  "file_size_bytes": 2500000
}'