vike-alerts-webhooklisted

# vike-alerts-webhook ## Registration ```bash vike alerts register-webhook <https://your-server.com/vike-hook> [--secret <16+ char HMAC secret>] [--json] ``` The secret is **optional but strongly recommended** — without it we still POST, but the recipient has no way to verify it came from us. ## Example ```bash # Generate a strong secret first openssl rand -hex 32 # → 7f5c8b... (paste below) vike alerts register-webhook https://api.mycoolbot.com/vike-alert \ --secret 7f5c8b... \ --json # → { "ok": true, "channel_id": 42, "url_preview": "https://api.myc...", "signed": true } ``` Then create an alert and reference the channel — webhooks fire alongside email/discord. (Currently the `alerts create` flow doesn't accept channel IDs directly; webhooks fire if they're the user's enabled channels.) ## What we POST to your URL ```http POST /vike-hook HTTP/1.1 Content-Type: application/json User-Agent: vike-alerts/1.0 X-Vike-Timestamp: 1716658923 X-Vike-Signature: t=1716658923,sig=a3f8b2c... {"alert_id":42,"alert_label":"Big USDC moves","alert_type":"transfer","triggered_at":"2026-05-25T17:42:00+00:00","chain":"eth","token":"USDC","value_usd":1234567.89,"from_address":"0x...","to_address":"0x...","tx_hash":"0x..."} ``` ## How to verify the signature (Python) ```python import hmac, hashlib, time def verify(secret, headers, body): sig_header = headers.get("X-Vike-Signature", "") parts = dict(p.split("=", 1) for p in sig_header.split(",")) ts, sig = parts.