curl https://app.mysylva.app/api/v1/tasks \
  -H "Authorization: Bearer sylva_oauth_<your_token>" \
  -H "Content-Type: application/json"

const response = await fetch("https://app.mysylva.app/api/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "authorization_code",
    code: "<authorization_code>",
    redirect_uri: "https://yourapp.com/callback",
    client_id: "<your_client_id>",
    client_secret: "<your_client_secret>",
    code_verifier: "<pkce_code_verifier>",
  }),
});

// Refreshing needs the same client_id and client_secret:
// grant_type=refresh_token, refresh_token, client_id, client_secret

const { access_token, refresh_token, expires_in } = await response.json();

{
  "id": "evt_a3f9c12b8e4d",
  "type": "task.created",
  "created_at": "2026-05-05T12:00:00Z",
  "data": {
    "id": "uuid",
    "content": "Review Q2 metrics",
    "status": "pending",
    "created_at": "2026-05-05T12:00:00Z"
  },
  "previous_data": null
}

import crypto from "crypto";

function verifyWebhook(body, headers, secret) {
  const timestamp = headers["x-sylva-timestamp"];
  const signature = headers["x-sylva-signature"];

  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${body}`)
    .digest("hex");

  // Protect against timing attacks
  const sigBuffer = Buffer.from(signature);
  const expectedBuffer = Buffer.from(expected);
  return sigBuffer.length === expectedBuffer.length &&
    crypto.timingSafeEqual(sigBuffer, expectedBuffer);
}