Sign Invoices and Contracts from Xero — Australia's #1 Accounting Platform

// Xero webhook handler — invoice approved trigger
// POST to this endpoint from Xero's webhook configuration

import crypto from "crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const xeroSignature = req.headers.get("x-xero-signature");

  // Validate Xero webhook signature
  const expectedSignature = crypto
    .createHmac("sha256", process.env.XERO_WEBHOOK_KEY!)
    .update(rawBody)
    .digest("base64");

  if (expectedSignature !== xeroSignature) {
    return new Response("Unauthorised", { status: 401 });
  }

  const payload = JSON.parse(rawBody);
  const events = payload.events ?? [];

  for (const event of events) {
    if (
      event.eventType === "UPDATE" &&
      event.eventCategory === "INVOICE"
    ) {
      const invoiceId = event.resourceId;

      // Fetch the invoice PDF from Xero
      const pdfUrl =
        `https://api.xero.com/api.xro/2.0/Invoices/${invoiceId}/pdf`;

      // POST to SignBolt REST API
      const formData = new FormData();
      formData.append("fileUrl", pdfUrl);
      formData.append("signerEmail", event.tenantId); // replace with contact email
      formData.append(
        "webhookUrl",
        "https://signbolt.store/api/integrations/xero/webhook"
      );

      await fetch("https://signbolt.store/api/v1/sign", {
        method: "POST",
        headers: {
          Authorization: `Bearer ${process.env.SIGNBOLT_API_KEY}`,
        },
        body: formData,
      });
    }
  }

  return new Response("OK", { status: 200 });
}

// SignBolt fires this payload to your Xero webhook handler
// when a document is signed

{
  "event": "document.signed",
  "documentId": "doc_xro_abc123",
  "signerEmail": "client@example.com.au",
  "signedAt": "2026-04-08T10:32:00+10:00",
  "downloadUrl": "https://signbolt.store/api/documents/doc_xro_abc123/download",
  "metadata": {
    "xeroInvoiceId": "INV-0042",
    "xeroTenantId": "your-xero-tenant-id"
  }
}