curl -X POST https://api.muvi.video/v1/jobs/submit \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "modelSlug": "stability/sdxl",
    "modelVersion": "v1",
    "input": {
      "prompt": "A serene mountain landscape"
    },
    "webhookUrl": "https://your-app.com/webhooks/pixelbyte"
  }'

const response = await fetch("https://api.muvi.video/v1/jobs/submit", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    modelSlug: "stability/sdxl",
    modelVersion: "v1",
    input: {
      prompt: "A serene mountain landscape"
    },
    webhookUrl: "https://your-app.com/webhooks/pixelbyte"
  })
});

import requests

response = requests.post(
    "https://api.muvi.video/v1/jobs/submit",
    headers={
        "Authorization": "Bearer YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    json={
        "modelSlug": "stability/sdxl",
        "modelVersion": "v1",
        "input": {
            "prompt": "A serene mountain landscape"
        },
        "webhookUrl": "https://your-app.com/webhooks/pixelbyte"
    }
)

const crypto = require("crypto");

function verifyWebhookSignature(req, webhookSecret) {
  const timestamp = req.headers["x-pixelbyte-timestamp"];
  const signature = req.headers["x-pixelbyte-signature"];

  if (!timestamp || !signature) {
    return false;
  }

  // Reject requests older than 5 minutes
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp);
  if (age > 300) {
    return false;
  }

  const rawBody = JSON.stringify(req.body);
  const signedPayload = `${timestamp}.${rawBody}`;

  const expectedSignature = "sha256=" + crypto
    .createHmac("sha256", webhookSecret)
    .update(signedPayload)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Express.js example
app.post("/webhooks/pixelbyte", express.json(), (req, res) => {
  const isValid = verifyWebhookSignature(req, process.env.WEBHOOK_SECRET);

  if (!isValid) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  // Respond 200 immediately
  res.status(200).json({ received: true });

  // Process asynchronously
  processWebhook(req.body).catch(console.error);
});

import hmac
import hashlib
import time
from flask import Flask, request, jsonify

app = Flask(__name__)

def verify_webhook_signature(request, webhook_secret):
    timestamp = request.headers.get("X-PixelByte-Timestamp")
    signature = request.headers.get("X-PixelByte-Signature")

    if not timestamp or not signature:
        return False

    # Reject requests older than 5 minutes
    age = int(time.time()) - int(timestamp)
    if age > 300:
        return False

    raw_body = request.get_data(as_text=True)
    signed_payload = f"{timestamp}.{raw_body}"

    expected_signature = "sha256=" + hmac.new(
        webhook_secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected_signature)


@app.route("/webhooks/pixelbyte", methods=["POST"])
def handle_webhook():
    if not verify_webhook_signature(request, WEBHOOK_SECRET):
        return jsonify({"error": "Invalid signature"}), 401

    # Respond 200 immediately
    payload = request.get_json()

    # Queue for async processing
    process_webhook_async(payload)

    return jsonify({"received": True}), 200