{
  "valid":      true,
  "core_valid": true,
  "date_valid": true,
  "reason":     "All checks passed.",
  "requestId":  "8f3c2a1b-4d9e-…",
  "detected": {
    "bank":          "GTBank",
    "amount":        5000,
    "name":          "Ayo David",
    "accountNumber": "0123456789",
    "date":          "2026-06-27",
    "transactionId": "220626…"
  }
}

{
  "valid":      false,
  "core_valid": false,
  "date_valid": true,
  "reason":     "Account number on receipt (0123456788) does not match expected (0123456789). Last digit appears digitally altered.",
  "requestId":  "4d9a7e2f-…",
  "detected": {
    "bank":          "GTBank",
    "amount":        5000,
    "accountNumber": "0123456788",  // what the AI actually saw
    "date":          "2026-06-27"
  }
}

const source = new EventSource(
  `https://receiptor-x.onrender.com/api/events/stream?token=${jwtToken}`
);

source.addEventListener('connected', () => {
  console.log('🟢 Stream connected');
});

source.addEventListener('verification', e => {
  const event = JSON.parse(e.data);
  // event = { valid, bank, amount, accountNumber, reason, requestId, createdAt }

  if (event.valid) {
    console.log('✓ Valid', event.bank, 'NGN', event.amount);
  } else {
    console.warn('✗ Flagged:', event.reason);
  }
});

source.onerror = () => source.close(); // reconnect as needed

{
  "event":         "verification.complete",
  "valid":         true,
  "bank":          "GTBank",
  "amount":        5000,
  "accountNumber": "0123456789",
  "reason":        "All checks passed.",
  "requestId":     "8f3c2a1b-…",
  "createdAt":     "2026-06-27T12:00:00.000Z"
}

import { createHmac, timingSafeEqual } from 'crypto';

function verifySignature(rawBody, signature, secret) {
  const expected = 'sha256=' + createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  const a = Buffer.from(expected);
  const b = Buffer.from(signature);

  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b); // timing-safe compare
}

// In your Express route:
app.post('/webhooks/rcx', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.headers['x-receiptorx-signature'];
  if (!verifySignature(req.body, sig, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  const event = JSON.parse(req.body);
  // handle event.valid, event.bank, etc.
  res.sendStatus(200);
});

HTTP/1.1 429 Too Many Requests
Retry-After:           42
RateLimit-Limit:       30
RateLimit-Remaining:   0
RateLimit-Reset:       1751026800

export class ReceiptorX {
  constructor(apiKey) {
    this.apiKey  = apiKey;
    this.baseUrl = 'https://receiptor-x.onrender.com';
  }

  async verify(image, config) {
    const res = await fetch(`${this.baseUrl}/api/verify`, {
      method:  'POST',
      headers: { 'X-Api-Key': this.apiKey, 'Content-Type': 'application/json' },
      body:    JSON.stringify({ image, config }),
    });
    if (!res.ok) throw new Error(`ReceiptorX ${res.status}: ${(await res.json()).message}`);
    return res.json();
  }
}

// Usage:
const rcx    = new ReceiptorX('rcx_live_…');
const result = await rcx.verify(imageDataUrl, {
  expectedRecipientName: 'Ayo David',
  expectedBankName:      'GTBank',
  expectedAmount:        5000,
  expectedAccountNumber: '0123456789',
});

if (result.valid) {
  console.log('Receipt is genuine ✓');
} else {
  console.warn('Fraud detected:', result.reason);
}

{
  "status":    "ok",
  "service":   "ReceiptorX",
  "timestamp": "2026-06-27T12:00:00.000Z"
}