Integra Tiketa en tu producto

curl http://localhost:3001/api/v1/events \
  -H "Authorization: Bearer tk_demo_123"

{
  "error": {
    "code": "rate_limited",
    "message": "Superaste el límite de 100 solicitudes por minuto. Espera unos segundos y reintenta."
  }
}

curl http://localhost:3001/api/v1/events/peru-blockchain-conference-2026 \
  -H "Authorization: Bearer tk_demo_123"

{
  "events": [
    {
      "id": "cmev8xk2l0000tiketa01",
      "slug": "peru-blockchain-conference-2026",
      "name": "Perú Blockchain Conference 2026",
      "country": "PE",
      "city": "Lima",
      "venue": "JW Marriott Larcomar",
      "startDate": "2026-07-11T14:00:00.000Z",
      "endDate": "2026-07-12T03:00:00.000Z",
      "logoUrl": "http://localhost:3001/uploads/logo-pbconf26.png",
      "coverUrl": "http://localhost:3001/uploads/pbconf26-cover.jpg",
      "url": "http://localhost:3001/e/peru-blockchain-conference-2026",
      "ticketTypes": [
        {
          "id": "cmev8xk2l0003tiketa01",
          "name": "VIP",
          "price": 249,
          "compareAtPrice": 399,
          "currency": "USD",
          "featuresHtml": "<ul><li>Asientos preferenciales…</li></ul>",
          "highlight": true,
          "soldOut": false,
          "remaining": 269
        }
      ]
    }
  ]
}

curl -X POST http://localhost:3001/api/v1/checkout-sessions \
  -H "Authorization: Bearer tk_demo_123" \
  -H "Content-Type: application/json" \
  -d '{
    "ticketTypeId": "TICKET_TYPE_ID",
    "prefill": {
      "name": "Camila Rojas",
      "email": "camila@tuapp.com",
      "role": "Head of Growth"
    },
    "lockedFields": ["name", "email"],
    "metadata": { "userId": "u_8123", "campaign": "black-friday" },
    "redirectUrl": "https://tuapp.com/gracias",
    "theme": { "accent": "#2E78FF", "onAccent": "#FFFFFF" }
  }'

{
  "id": "cmses9dk10000tiketa9",
  "url": "http://localhost:3001/embed/checkout/cmses9dk10000tiketa9",
  "status": "open",
  "expiresAt": "2026-07-17T16:34:00.000Z",
  "ticketType": { "id": "TICKET_TYPE_ID", "name": "GENERAL", "price": 29, "currency": "USD" },
  "priceOverride": null,
  "theme": {
    "accent": "#2e78ff",
    "onAccent": "#FFFFFF",
    "accentSoft": "#6ba1ff",
    "accentDeep": "#2662d1"
  }
}

# Por id de orden o por código legible (K7M-4P2)
curl http://localhost:3001/api/v1/orders/K7M-4P2 \
  -H "Authorization: Bearer tk_demo_123"

curl "http://localhost:3001/api/v1/orders?email=ana@empresa.com" \
  -H "Authorization: Bearer tk_demo_123"

{
  "order": {
    "id": "cmord2xk10000tiketa5",
    "code": "K7M-4P2",
    "status": "paid",
    "source": "embed",
    "amount": 29,
    "currency": "USD",
    "paymentMethod": "stripe",
    "paymentRef": "pi_3PqX…",
    "buyer": {
      "name": "Ana Rodríguez",
      "email": "ana@empresa.com",
      "role": "Backend Developer",
      "company": "Yape"
    },
    "event": {
      "id": "cmev8xk2l0000tiketa01",
      "slug": "peru-blockchain-conference-2026",
      "name": "Perú Blockchain Conference 2026",
      "startDate": "2026-07-11T14:00:00.000Z"
    },
    "ticketType": { "id": "cmev8xk2l0002tiketa01", "name": "GENERAL", "price": 29 },
    "checkedInAt": null,
    "metadata": { "userId": "u_8123" },
    "ticketUrl": "http://localhost:3001/ticket/K7M-4P2",
    "createdAt": "2026-07-17T15:02:11.000Z"
  }
}

# Solo consultar el estado
curl -X POST http://localhost:3001/api/v1/tickets/validate \
  -H "Authorization: Bearer tk_demo_123" \
  -H "Content-Type: application/json" \
  -d '{ "code": "K7M-4P2" }'

# Registrar el ingreso de verdad (marca check-in + webhook ticket.checked_in)
curl -X POST http://localhost:3001/api/v1/tickets/validate \
  -H "Authorization: Bearer tk_demo_123" \
  -H "Content-Type: application/json" \
  -d '{ "qrToken": "3f9a1b…", "checkIn": true }'

{
  "ticket": {
    "status": "valid",
    "checkedIn": true,
    "checkedInAt": "2026-07-11T14:22:40.000Z",
    "code": "K7M-4P2",
    "orderId": "cmord2xk10000tiketa5",
    "buyer": { "name": "Ana Rodríguez", "email": "ana@empresa.com", "role": "Backend Developer", "company": "Yape" },
    "event": { "slug": "peru-blockchain-conference-2026", "name": "Perú Blockchain Conference 2026", "startDate": "2026-07-11T14:00:00.000Z" },
    "ticketType": { "id": "cmev8xk2l0002tiketa01", "name": "GENERAL" }
  }
}

# Sin API key — pensado para pintar tiers desde el navegador (CORS *)
curl http://localhost:3001/api/public/events/peru-blockchain-conference-2026

<!-- 1) Carga el script una sola vez -->
<script src="http://localhost:3001/embed.js" async></script>

<!-- 2) Abre el checkout donde quieras -->
<button id="comprar-vip">Comprar VIP</button>

<script>
  document.getElementById("comprar-vip").addEventListener("click", function () {
    Tiketa.open({
      ticketTypeId: "TICKET_TYPE_ID",
      onSuccess: function (data) {
        // data = { orderId, code }
        console.log("Entrada vendida:", data.code);
      },
      onClose: function () {
        console.log("Checkout cerrado");
      },
    });
  });
</script>

// 1) SERVER-SIDE: crea la sesión con tu API key (nunca la expongas en el navegador)
const res = await fetch("http://localhost:3001/api/v1/checkout-sessions", {
  method: "POST",
  headers: {
    Authorization: "Bearer tk_demo_123",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    ticketTypeId: "TICKET_TYPE_ID",
    prefill: { name: "Camila Rojas", email: "camila@tuapp.com", role: "Head of Growth" },
    lockedFields: ["name", "email", "role"],
    priceOverride: 0, // 0 = entrada cortesía (regalos, ruletas, ganadores)
    redirectUrl: "https://tuapp.com/gracias",
    // Los botones del checkout se pintan con TU acento. Solo `accent` es
    // obligatorio: el texto de encima se elige por contraste y las variantes
    // clara/oscura se derivan, así que con un color basta.
    theme: { accent: "#2E78FF", onAccent: "#FFFFFF" },
  }),
});
const session = await res.json(); // { id, url, expiresAt, ... }

// 2) CLIENT-SIDE: abre el widget con esa sesión
Tiketa.open({ session: session.id, baseUrl: "http://localhost:3001" });

// Modo inline: el checkout vive dentro de tu página (sin overlay).
// El iframe ajusta su altura solo con los mensajes tiketa:resize.
const handle = Tiketa.mount(document.getElementById("checkout"), {
  ticketTypeId: "TICKET_TYPE_ID",
  onSuccess: (data) => console.log("Orden", data.orderId),
});

// Al desmontar tu vista:
handle.destroy();

POST https://tuapp.com/webhooks/tiketa
Content-Type: application/json
User-Agent: Tiketa-Webhooks/1.0
X-Tiketa-Event: order.paid
X-Tiketa-Delivery: cmdel8xk20000tiketa7
X-Tiketa-Signature: t=1789000000,v1=5f8a2c41d9…

{
  "id": "cmdel8xk20000tiketa7",
  "type": "order.paid",
  "createdAt": "2026-07-17T15:04:05.000Z",
  "data": {
    "orderId": "cmord2xk10000tiketa5",
    "code": "K7M-4P2",
    "status": "paid",
    "paymentMethod": "stripe",
    "paymentRef": "pi_3PqX…",
    "eventSlug": "peru-blockchain-conference-2026",
    "ticketType": "GENERAL",
    "amount": 29,
    "currency": "USD",
    "buyer": { "name": "Ana Rodríguez", "email": "ana@empresa.com" },
    "metadata": "{\"userId\":\"u_8123\"}"
  }
}

const crypto = require("crypto");
const express = require("express");

/**
 * Verifica el header X-Tiketa-Signature: "t={timestamp},v1={hmac}".
 * v1 = HMAC-SHA256 de "{timestamp}.{rawBody}" con tu webhookSecret (whsec_…).
 * Tolerancia de 5 minutos contra replay. Comparación en tiempo constante.
 */
function verifyTiketaSignature(rawBody, signatureHeader, webhookSecret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((kv) => kv.split("="))
  );
  const timestamp = Number(parts.t);
  if (!timestamp || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;

  const expected = crypto
    .createHmac("sha256", webhookSecret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();

// IMPORTANTE: usa el body CRUDO para verificar — nunca el JSON re-serializado.
app.post(
  "/webhooks/tiketa",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const ok = verifyTiketaSignature(
      req.body.toString("utf8"),
      req.get("X-Tiketa-Signature") || "",
      process.env.TIKETA_WEBHOOK_SECRET
    );
    if (!ok) return res.status(401).send("firma inválida");

    const evento = JSON.parse(req.body);
    switch (evento.type) {
      case "order.paid":
        // Entrega el acceso, actualiza tu CRM, emite la factura…
        break;
      case "order.created":
      case "ticket.checked_in":
        break;
    }

    // Responde 2xx rápido: si no, Tiketa reintenta 3 veces (1s / 10s / 60s).
    res.sendStatus(200);
  }
);

app.listen(4000);