await commerce.webhooks.create({
  url: 'https://myapp.com/webhooks/commerce',
  events: [
    'checkout.completed',
    'subscription.created',
    'payment.succeeded',
    'payment.failed'
  ],
  secret: 'whsec_...'  // optional, auto-generated if omitted
})

app.post('/webhooks/commerce', (req, res) => {
  const signature = req.headers['x-hanzo-signature']

  try {
    const event = commerce.webhooks.verify(
      req.rawBody,
      signature,
      process.env.WEBHOOK_SECRET
    )

    // Handle event
    switch (event.type) {
      case 'checkout.completed':
        await fulfillOrder(event.data)
        break
      case 'payment.failed':
        await notifyCustomer(event.data)
        break
    }

    res.status(200).json({ received: true })
  } catch (err) {
    res.status(400).json({ error: 'Invalid signature' })
  }
})