E-Signatures for QuickBooks — Sign Contracts Without Leaving Your Books

// QuickBooks webhook handler — invoice approved trigger
// POST to this endpoint from QuickBooks webhook configuration

import crypto from "crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const intuitSignature = req.headers.get("intuit-signature");

  // Validate QuickBooks webhook signature
  const expectedSignature = crypto
    .createHmac("sha256", process.env.QUICKBOOKS_WEBHOOK_VERIFIER_TOKEN!)
    .update(rawBody)
    .digest("base64");

  if (expectedSignature !== intuitSignature) {
    return new Response("Unauthorised", { status: 401 });
  }

  const payload = JSON.parse(rawBody);
  const entities = payload.eventNotifications?.[0]?.dataChangeEvent?.entities ?? [];

  for (const entity of entities) {
    if (entity.name === "Invoice" && entity.operation === "Update") {
      const invoiceId = entity.id;

      // Fetch invoice PDF from QuickBooks API
      const invoicePdfUrl =
        `https://quickbooks.api.intuit.com/v3/company/${process.env.QB_REALM_ID}/invoice/${invoiceId}/pdf`;

      // Get signer email from QuickBooks customer
      // (Fetch invoice first to get CustomerRef, then get customer email)
      const signerEmail = "customer@example.com"; // replace with actual lookup

      // POST to SignBolt REST API
      const formData = new FormData();
      formData.append("fileUrl", invoicePdfUrl);
      formData.append("signerEmail", signerEmail);
      formData.append(
        "webhookUrl",
        "https://signbolt.store/api/integrations/quickbooks/webhook"
      );
      formData.append(
        "metadata",
        JSON.stringify({ quickbooksInvoiceId: invoiceId })
      );

      await fetch("https://signbolt.store/api/v1/sign", {
        method: "POST",
        headers: {
          Authorization: `Bearer ${process.env.SIGNBOLT_API_KEY}`,
        },
        body: formData,
      });
    }
  }

  return new Response("OK", { status: 200 });
}

// SignBolt fires this payload to your QuickBooks webhook handler
// when a document is signed

{
  "event": "document.signed",
  "documentId": "doc_qb_abc123",
  "signerEmail": "client@example.com",
  "signedAt": "2026-04-08T10:32:00Z",
  "downloadUrl": "https://signbolt.store/api/documents/doc_qb_abc123/download",
  "metadata": {
    "quickbooksInvoiceId": "INV-1042",
    "quickbooksRealmId": "your-realm-id"
  }
}