cred.diy API documentation

npm install @cred/sdk
# or
yarn add @cred/sdk
# or
pnpm add @cred/sdk

import { CredClient } from '@cred/sdk';

// Initialize the client
const cred = new CredClient({
  apiKey: process.env.CRED_API_KEY,
  projectId: 'your_project_id',
  // Which of your apps these calls come from. Sent as x-app-origin and used
  // for signup attribution. In the browser it defaults to the page origin;
  // on a server, set it — otherwise attribution stays blank.
  appOrigin: 'https://app1.example.com'
});

// Issue credits to a user
const result = await cred.credits.issue({
  user_id: 'user_123',
  amount: 100,
  reason: 'Welcome bonus'
});

if (result.success) {
  console.log('New balance:', result.data.balance);
}

// Deduct credits from a user
const result = await cred.credits.deduct({
  user_id: 'user_123',
  amount: 10,
  reason: 'API usage'
});

if (!result.success) {
  console.error('Error:', result.error?.message);
}

// Get user's credit balance
const balance = await cred.credits.getBalance({
  user_id: 'user_123'
});

console.log('Balance:', balance.data?.balance);

// List all pricing tiers
const tiers = await cred.pricing.list();
tiers.data?.forEach(tier => {
  console.log(`${tier.name}: ${tier.credits} credits for $${tier.price}`);
});

// Create a new pricing tier
const newTier = await cred.pricing.create({
  name: 'Starter Pack',
  description: 'Perfect for getting started',
  price: 9.99,
  credits: 100,
  currency: 'USD'
});

// Create a checkout session
const session = await cred.checkout.create({
  pricing_tier_id: 'tier_123',
  user_id: 'user_456',
  success_url: 'https://myapp.com/success',
  cancel_url: 'https://myapp.com/cancel'
});

// Redirect user to checkout
if (session.success) {
  window.location.href = session.data.checkout_url;
}

// Create or get a user
const user = await cred.users.createOrGet({
  external_id: 'auth0|123456',
  email: 'user@example.com',
  name: 'John Doe'
});

// Get user balances
const balances = await cred.users.getBalances('auth0|123456');

x-api-key: sk_live_your_api_key

// Issue credits to a user
// Note: user_email is recommended for wallet identity
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/issue',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_id: 'user_123',
      credit_type_id: 'your_credit_type_id',
      amount: 100,
      reason: 'Welcome bonus',
      user_email: 'user@example.com', // Recommended! Same email = same wallet
      user_name: 'John Doe'
    })
  }
);

const result = await response.json();
// { 
//   success: true, 
//   transaction_id: '...', 
//   user_id: 'user_123',
//   credit_type_id: '...',
//   amount_issued: 100,
//   new_balance: 100 
// }

// Deduct credits from a user
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/deduct',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_id: 'user_123',
      credit_type_id: 'your_credit_type_id',
      amount: 25,
      reason: 'API usage'
    })
  }
);

const result = await response.json();
// { 
//   success: true, 
//   transaction_id: '...', 
//   user_id: 'user_123',
//   credit_type_id: '...',
//   amount_deducted: 25,
//   new_balance: 75 
// }

// Get user's credit balance
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/balance?user_id=user_123',
  {
    headers: {
      'x-api-key': 'sk_live_your_api_key'
    }
  }
);

const result = await response.json();
// { 
//   user_id: 'user_123', 
//   balances: [{ 
//     credit_type_id: '...', 
//     credit_type_name: 'Tokens',
//     credit_type_symbol: 'TKN',
//     balance: 75 
//   }] 
// }

// Create or get a user
// Note: If a user with this email already exists, returns existing user's wallet
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/users',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      external_id: 'user_123',
      email: 'user@example.com', // Primary identifier - one email = one wallet
      name: 'John Doe',
      metadata: { plan: 'pro' }
    })
  }
);

const result = await response.json();
// { user: { id: '...', external_id: 'user_123', email: 'user@example.com', ... }, created: true }

// Sync all your existing users to CRED (up to 1000 per request)
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/users/bulk',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      users: [
        { external_id: 'user_1', email: 'user1@example.com', name: 'User One' },
        { external_id: 'user_2', email: 'user2@example.com', name: 'User Two' },
        { external_id: 'user_3', email: 'user3@example.com', name: 'User Three' }
      ]
    })
  }
);

const result = await response.json();
// { success: true, created: 2, updated: 1 }

// List all users with pagination
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/users?limit=100&offset=0',
  {
    headers: {
      'x-api-key': 'sk_live_your_api_key'
    }
  }
);

const result = await response.json();
// { users: [...], total: 150, limit: 100, offset: 0 }

// Update a user
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/users',
  {
    method: 'PATCH',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      external_id: 'user_123',
      name: 'Jane Doe',
      metadata: { plan: 'enterprise' }
    })
  }
);

const result = await response.json();
// { user: { id: '...', external_id: 'user_123', name: 'Jane Doe', ... } }

// Create a user with signup attribution
// signup_host is auto-derived from signup_url — no need to send it
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/users',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      external_id: 'user_123',
      email: 'user@example.com',
      signup_url: 'https://app1.example.com/signup?ref=twitter',
      signup_credit_type_id: 'ct_abc123'
    })
  }
);

// Filter users by attribution
// signup_host  — normalized hostname (e.g. app1.example.com)
// signup_credit_type_id — the credit type the user signed up for
const res = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/users?signup_host=app1.example.com&limit=100',
  { headers: { 'x-api-key': 'sk_live_your_api_key' } }
);

// GET /signup-analytics?days=30
// User counts, purchase counts, and revenue grouped by signup_host.
// Pass days=0 for all-time (default: 30).
const res = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/signup-analytics?days=30',
  { headers: { 'x-api-key': 'sk_live_your_api_key' } }
);

// {
//   "breakdown": [
//     {
//       "signup_host": "app1.example.com",
//       "signup_credit_type_id": "ct_abc",
//       "signup_credit_type_name": "GEMS",
//       "user_count": 1250,
//       "purchase_count": 87,
//       "revenue": 4321.50
//     }
//   ]
// }

// List all pricing tiers for your project
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/pricing-tiers',
  {
    headers: {
      'x-api-key': 'sk_live_your_api_key'
    }
  }
);

const result = await response.json();
// { pricing_tiers: [{ id: '...', name: 'Starter', price: 9.99, credits: 100, ... }] }

// Create a new pricing tier programmatically
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/pricing-tiers',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      name: 'Pro Pack',
      description: 'Best value for power users',
      price: 29.99,
      credits: 500,
      currency: 'USD',
      billing_type: 'one_time',  // or 'subscription'
      is_popular: true,
      // Optional: restrict this tier to specific credit types.
      // Omit or pass [] to make the tier available for ALL credit types in the project.
      credit_type_ids: ['ct_abc123']
    })
  }
);

const result = await response.json();
// { 
//   success: true, 
//   pricing_tier: { 
//     id: 'tier_abc123',  // Use this ID for checkout
//     name: 'Pro Pack', 
//     price: 29.99, 
//     credits: 500,
//     ...
//   } 
// }

// List available swap pairs
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/swap-pairs',
  {
    headers: {
      'x-api-key': 'sk_live_your_api_key'
    }
  }
);

const result = await response.json();
// { swap_pairs: [{ id: '...', source_credit_type_name: 'Gold', target_credit_type_name: 'Silver', exchange_rate: 10, ... }] }

// Execute a credit swap
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/swap',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_id: 'user_123',
      swap_pair_id: 'swap_abc123',
      source_amount: 100
    })
  }
);

const result = await response.json();
// { 
//   success: true, 
//   transaction_id: 'swap_tx_xyz789',
//   source_amount: 100,
//   target_amount: 975,
//   exchange_rate: 10,
//   fee_amount: 25,
//   source_new_balance: 400,
//   target_new_balance: 1975
// }

// Reserve credits into escrow (hold)
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/escrow/hold',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_email: 'buyer@example.com',
      credit_type_id: 'ct_abc123',
      amount: 100,
      reference_id: 'order_789'
    })
  }
);

const result = await response.json();
// { success: true, hold_id: 'hold_abc123', status: 'held', amount: 100, new_balance: 150 }

// Capture (settle) a hold — optionally to a different user (marketplace/P2P).
// Any uncaptured remainder is released back to the holder.
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/escrow/capture',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      hold_id: 'hold_abc123',
      to_user_email: 'seller@example.com'
      // amount: 60  // optional — partial capture, remainder released
    })
  }
);

const result = await response.json();
// {
//   success: true,
//   hold_id: 'hold_abc123',
//   status: 'captured',
//   captured_amount: 100,
//   remainder_released: 0,
//   to_user_id: 'seller_456',
//   recipient_new_balance: 100,
//   holder_new_balance: 150
// }
// To cancel instead, POST /escrow/release with { hold_id }.

// Attach an address to a user. One call, no signature — you are
// vouching for it. Use this when your app already ran its own
// wallet-connect flow and knows the address is theirs.
await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/users',
  {
    method: 'PATCH',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_email: 'user@example.com',
      wallet_address: '0x1234567890abcdef1234567890abcdef12345678'
    })
  }
);

// The same field works on POST /users and POST /users/bulk, so a wallet
// can be attached at signup rather than in a second round trip.

// Or prove it. Two calls: ask for a message, send back the signature.

// 1. Get a challenge. The message names YOUR project, not Cred — it is
//    what the user reads in their wallet popup, so show it unmodified.
const challenge = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/wallet/challenge',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_email: 'user@example.com',
      address: await signer.getAddress()
    })
  }
).then(r => r.json());
// { nonce: '9f8e…', address: '0x1234…', message: 'Your App wants to…',
//   expires_at: '2026-08-17T12:10:00.000Z' }

// 2. Sign it and send it back.
const signature = await signer.signMessage(challenge.message);

const result = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/wallet/verify',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({ nonce: challenge.nonce, signature })
  }
).then(r => r.json());
// { verified: true, user: { wallet_address: '0x1234…',
//                           wallet_verified_at: '2026-08-17T12:01:04.221Z' } }

// A challenge is single-use and lasts ten minutes. A rejected signature
// consumes it too — retry means requesting a fresh one.

// With a wallet on file and an on-chain credit type, issuing credits
// also mints tokens. The response tells you what happened on-chain.
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/issue',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_id: 'user_123',
      user_email: 'user@example.com',
      credit_type_id: 'your_credit_type_id',
      amount: 100,
      reason: 'Welcome bonus',
      // Optional: mint this one issuance elsewhere, ignoring the
      // address on the user.
      wallet_address: '0xabcdef1234567890abcdef1234567890abcdef12'
    })
  }
);

const data = await response.json();
// {
//   balance: 100,
//   transaction_id: 'txn_abc123',
//   on_chain: {
//     status: 'enqueued',
//     mint_id: 'mint_abc',
//     transaction_hash: '0x9f8e…'
//   }
// }

// The ledger is the system of record and the chain follows it. A mint that
// cannot be sent NEVER fails the issuance — you get status 'skipped' and a
// reason instead:
//   "no wallet address for this end user — set end_users.wallet_address"
if (data.on_chain?.status === 'skipped') {
  console.warn('Credits issued, no token minted:', data.on_chain.reason);
}

// Read which credit types are on-chain, and where they live.
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/credit-types',
  { headers: { 'x-api-key': 'sk_live_your_api_key' } }
);

// {
//   "credit_types": [{
//     "id": "ct_abc",
//     "name": "Game Coins",
//     "symbol": "GC",
//     "exchange_rate": 100,
//     "is_on_chain": true,
//     "blockchain": "base-sepolia",
//     "contract_address": "0x5FbDB2315678afecb367f032d93F642f64180aa3",
//     "chain_id": 84532,
//     "token_decimals": 18,
//     "mint_on_issue": true,
//     "deployment_type": "managed"
//   }]
// }

// Enough to build an explorer link, convert a credit amount to atomic
// units, or offer "add this token to your wallet".

// Any credits-api call can now be paid for inline. When your CRD runs
// out the API answers 402 with a price instead of simply failing.
const call = () => fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/balance?user_id=user_123',
  { headers: { 'x-api-key': 'sk_live_your_api_key' } }
);

let response = await call();

if (response.status === 402) {
  const offer = JSON.parse(atob(response.headers.get('PAYMENT-REQUIRED')));
  // offer.accepts[0] -> { scheme, network, amount, asset, payTo, extra }
  const payload = await wallet.signX402(offer.accepts[0]);

  // Retry the *same* request with the signed payment attached.
  response = await fetch(response.url, {
    headers: {
      'x-api-key': 'sk_live_your_api_key',
      'PAYMENT-SIGNATURE': btoa(JSON.stringify(payload))
    }
  });
  // 200 OK — credits were topped up and the original request ran.
  // PAYMENT-RESPONSE header carries the on-chain settlement receipt.
}

// 1. Discover what Cred accepts — no credentials needed.
const res = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/x402/supported' +
  '?project_id=your_project_id'
);

const support = await res.json();
// {
//   x402Version: 2,
//   enabled: true,
//   kinds: [{ x402Version: 2, scheme: 'exact', network: 'eip155:84532' }],
//   asset: { address: '0x036CbD...', name: 'USDC', decimals: 6 },
//   facilitator: 'https://x402.org/facilitator',
//   platform_topup: { credits: 100, symbol: 'CRD', price_usd: 1, amount: '1000000' },
//   project: {
//     accepts_x402: true,
//     purchase_url: '.../credits-api/x402/purchase',
//     credit_type: { id: '...', name: 'Game Coins', symbol: 'GC' },
//     price_per_credit_usd: 0.01,
//     min_credits: 1,
//     max_credits: 10000
//   }
// }

// 2. Ask to buy. With no payment attached you get a 402 carrying the price.
const url =
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/x402/purchase';
const order = { project_id: 'your_project_id', credits: 500 };

const quote = await fetch(url, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(order)
});
// quote.status === 402
const paymentRequired = JSON.parse(atob(quote.headers.get('PAYMENT-REQUIRED')));

// 3. Sign the chosen requirements with your wallet (EIP-3009 for USDC), then
//    retry the same request with the signed payload.
const paid = await fetch(url, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'PAYMENT-SIGNATURE': btoa(JSON.stringify(signedPaymentPayload))
  },
  body: JSON.stringify(order)
});

const receipt = await paid.json();
// {
//   success: true,
//   credits_purchased: 500,
//   new_balance: 500,
//   buyer_id: 'x402:0xAgentWallet...',
//   payer: '0xAgentWallet...',
//   price_paid: 5,
//   currency: 'USDC',
//   transaction: '0xabc...'
// }
// The settlement receipt is also on the PAYMENT-RESPONSE response header.

// Create a hosted checkout session for credit purchases
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/hosted-checkout',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_id: 'user_123',
      user_email: 'user@example.com',
      pricing_tier_id: 'your_pricing_tier_id',
      success_url: 'https://yourapp.com/success',
      cancel_url: 'https://yourapp.com/cancel',
      // billing: 'recurring' // Explicitly opt in to monthly billing
    })
  }
);

const result = await response.json();
// { 
//   url: 'https://checkout.stripe.com/...', 
//   session_id: '...', 
//   purchase_id: '...' 
// }
// Redirect user to result.url to complete purchase

// Refund a purchase (claws back credits + optional Stripe money refund)
// Identify the source with ONE of: purchase_id, stripe_payment_intent_id,
// transaction_id, or reference_id. Refunds are idempotent.
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/refund',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      purchase_id: 'pur_abc123',
      // amount: 50,          // optional — partial refund
      // refund_payment: true, // optional — also refund the Stripe payment (default true)
      reason: 'Customer requested refund'
    })
  }
);

const result = await response.json();
// {
//   success: true,
//   refund_transaction_id: 'tx_refund_123',
//   refunded_credits: 100,
//   partial: false,
//   new_balance: 200,
//   credits_clawed_back: true,
//   payment_refunded: true,
//   stripe_refund_id: 're_1Nv9...',
//   source: 'purchase'
// }

// Create a presale checkout session
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/presale-checkout',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      presale_id: 'your_presale_id',
      email: 'buyer@example.com',
      name: 'John Doe',
      success_url: 'https://yourapp.com/presale-success',
      cancel_url: 'https://yourapp.com/presale-cancel'
    })
  }
);

const result = await response.json();
// { 
//   url: 'https://checkout.stripe.com/...', 
//   session_id: '...', 
//   order_id: '...' 
// }

// Configure referral program settings
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/referral-settings',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      is_active: true,
      referrer_credits: 100,
      referee_credits: 50,
      credit_type_id: 'your_credit_type_id'
    })
  }
);

const result = await response.json();
// { 
//   success: true, 
//   settings: {
//     id: '...',
//     is_active: true,
//     referrer_credits: 100,
//     referee_credits: 50,
//     credit_type_id: '...',
//     credit_type_name: 'Tokens'
//   }
// }

// Generate a referral code for a user
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/referrals/generate-code',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_id: 'user_123'
    })
  }
);

const result = await response.json();
// { 
//   success: true, 
//   user_id: 'user_123',
//   referral_code: 'ABC12XYZ'
// }

// Apply a referral code for a new user
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/referrals/apply',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'x-api-key': 'sk_live_your_api_key'
    },
    body: JSON.stringify({
      user_id: 'new_user_456',
      referral_code: 'ABC12XYZ'
    })
  }
);

const result = await response.json();
// { 
//   success: true, 
//   referral_id: '...',
//   referrer_credits_issued: 100,
//   referee_credits_issued: 50
// }

// List all referrals for your project
const response = await fetch(
  'https://eutdgemlrpvnxfkkpvlu.supabase.co/functions/v1/credits-api/referrals?status=completed&limit=50',
  {
    headers: {
      'x-api-key': 'sk_live_your_api_key'
    }
  }
);

const result = await response.json();
// { 
//   referrals: [{ id: '...', referral_code: 'ABC12XYZ', status: 'completed', ... }],
//   total: 25,
//   limit: 50,
//   offset: 0
// }

// Set up webhook listener (Express.js example)
const crypto = require('crypto');

app.post('/webhooks/cred', (req, res) => {
  // Verify signature
  const signature = req.headers['x-cred-signature'];
  const expectedSig = crypto
    .createHmac('sha256', 'your_webhook_secret')
    .update(JSON.stringify(req.body))
    .digest('hex');
  
  if (signature !== expectedSig) {
    return res.status(401).send('Invalid signature');
  }

  const event = req.body;
  
  switch (req.headers['x-cred-event']) {
    case 'credits.issued':
      console.log('Credits issued:', event);
      break;
    case 'credits.deducted':
      console.log('Credits deducted:', event);
      break;
    case 'purchase.completed':
      console.log('Purchase completed:', event);
      break;
  }
  
  res.status(200).send('OK');
});