Reserved seating SDK and API for your ticketing product.

import { SeatPicker } from '@seatlayer/js';

const picker = new SeatPicker({
  container: '#seat-picker',
  event: 'ev_9f3a', // change this at runtime
  onCheckout: async (_, __, handoff) => {
    await fetch('/api/checkout', {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ holdId: handoff.holdId }),
    });
  },
});
picker.render();

// your server — trust fresh hold data, never browser prices
const base = `https://api.seatlayer.io/v1/events/${eventKey}`;
const headers = { Authorization: `Bearer ${process.env.SEATLAYER_SECRET_KEY}` };
const hold = await fetch(`${base}/holds/${holdId}`, { headers })
  .then(r => r.json());
if (hold.status !== 'active') return conflict();

const order = await createOrderFrom(hold.items);
await fetch(`${base}/book`, {
  method: 'POST',
  headers: { ...headers, 'content-type': 'application/json' },
  body: JSON.stringify({ holdId, bookingRef: order.id }),
});

// capture raw bytes before JSON parsing
const expected = crypto.createHmac('sha256', process.env.WHSEC)
  .update(req.body).digest();
const sig = req.headers['x-seatlayer-signature'];
const exact = typeof sig === 'string' &&
  /^sha256=[0-9a-f]{64}$/i.test(sig);
const provided = Buffer.from(
  exact ? sig.slice(7) : '', 'hex');
const valid = exact && provided.length === expected.length &&
  crypto.timingSafeEqual(provided, expected);
if (!valid) return res.sendStatus(401);

const message = JSON.parse(req.body.toString('utf8'));
await enqueueOnce(message.occurrenceId, message);
res.sendStatus(200);

import { SeatLayer, SeatLayerConflictError, verifyWebhook } from '@seatlayer/server';
const seatlayer = new SeatLayer(process.env.SEATLAYER_SECRET_KEY);

// inspect the hold, then book with a stable reference
const hold = await seatlayer.inventory.retrieveHold(eventKey, holdId);
if (hold.status !== 'active') return conflict();
const order = await createOrderFrom(hold.items);
try {
  await seatlayer.inventory.book(eventKey, { holdId, bookingRef: order.id });
} catch (error) {
  if (error instanceof SeatLayerConflictError) return voidPayment(order);
  throw error; // timeouts: retry with the same bookingRef
}

// verify a delivery (throws on a bad signature)
const message = verifyWebhook({ payload: rawBody, signature: req.headers['x-seatlayer-signature'], secret: process.env.WHSEC });