Exemples SDK complets

Authentification → création de requête → validation Smart Event Card → webhook → sandbox. Code prêt à copier pour les trois SDKs officiels.

Mode sandbox — workflow de validation

Générez une clé sen_test_… depuis Studio → API (case "Mode sandbox"). Les endpoints répondent avec un événement fictif et 5 cartes de test reconnues :

card_number	Résultat attendu
TEST_VALID	200 OK — billet activé
TEST_VIP	200 OK — catégorie VIP
TEST_USED	400 — déjà activé
TEST_EXPIRED	400 — expiré
TEST_REVOKED	400 — carte révoquée

event_id sandbox : 00000000-0000-0000-0000-00000000e7e7

JavaScript / Node / Bun / Workers

import { SmartEventClient } from "https://smarteventnetwork.com/sdk/smart-event-card.js";

// 1) Auth — clé sandbox pour valider l'intégration, clé live en production
const sen = new SmartEventClient({
  apiKey: process.env.SEN_API_KEY, // ex: "sen_test_..."
});

// 2) Lister les événements (scope: events:read)
const events = await sen.events.list();
const eventId = events[0].id;

// 3) Valider une Smart Event Card sans la consommer (scope: cards:verify)
const check = await sen.card.verify("SEN1.TEST_VALID.0.0");
if (!check.valid) throw new Error("Carte invalide");

// 4) Activer le billet (scope: tickets:activate)
//    Le webhook 'ticket.activated' sera émis automatiquement.
const result = await sen.scan({ eventId, cardNumber: "TEST_VALID" });
console.log("Billet activé:", result.ticket_id, result.category_name);

React Native (Expo / Metro)

import { SmartEventClient } from "./smart-event-card-react-native";

const sen = new SmartEventClient({ apiKey: "sen_test_…" });

export async function validateAndScan(cardNumber: string, eventId: string) {
  // 1) Vérifier la carte (lecture seule)
  const c = await sen.card.verify(`SEN1.${cardNumber}.0.0`);
  if (!c.valid) return { ok: false, reason: "Carte invalide" };

  // 2) Scanner — déclenche le webhook ticket.activated
  try {
    const r = await sen.scan({ eventId, cardNumber });
    return { ok: true, ticketId: r.ticket_id };
  } catch (e) {
    return { ok: false, reason: e.message }; // ex: "Sandbox: billet deja active"
  }
}

Flutter / Dart

import 'package:smart_event_card/smart_event_card.dart';

Future<void> main() async {
  final sen = SmartEventClient(apiKey: 'sen_test_…');

  // 1) Lister les événements
  final events = await sen.listEvents();
  final eventId = events.first['id'] as String;

  // 2) Vérifier la carte
  final check = await sen.verifyCard('SEN1.TEST_VALID.0.0');
  if (check['valid'] != true) {
    throw Exception('Carte invalide');
  }

  // 3) Activer le billet (webhook ticket.activated émis)
  final result = await sen.scan(eventId: eventId, cardNumber: 'TEST_VALID');
  print('Billet active: ${result['ticket_id']}');

  sen.close();
}

Recevoir et vérifier les webhooks

Chaque event est posté en JSON, signé en HMAC-SHA256 (format Stripe-style) :

POST /votre/endpoint
content-type: application/json
x-sen-event: ticket.activated
x-sen-signature: t=1735000000000,v1=<hex64>

{
  "id": "evt_…",
  "type": "ticket.activated",
  "organization_id": "…",
  "created_at": "2026-06-22T19:00:00Z",
  "data": {
    "ticket_id": "…",
    "event_id": "…",
    "card_number": "SEN 1234 5678 9012",
    "activated_at": "2026-06-22T19:00:00Z"
  }
}

Vérification Node.js :

import crypto from "node:crypto";

export function verify(req, body /* raw string */, secret) {
  const header = req.headers["x-sen-signature"]; // "t=…,v1=…"
  const parts = Object.fromEntries(header.split(",").map(p => p.split("=")));
  const expected = crypto.createHmac("sha256", secret)
    .update(`${parts.t}.${body}`).digest("hex");
  const ok = crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
  if (!ok) throw new Error("Signature invalide");
  // Anti-rejeu : refuser si timestamp > 5 min
  if (Math.abs(Date.now() - Number(parts.t)) > 5 * 60_000) throw new Error("Stale");
  return JSON.parse(body);
}

Vérification Dart :

import 'dart:convert';
import 'package:crypto/crypto.dart';

Map<String, dynamic> verifyWebhook(String header, String body, String secret) {
  final parts = { for (final p in header.split(',')) p.split('=').first: p.split('=').last };
  final expected = Hmac(sha256, utf8.encode(secret))
      .convert(utf8.encode('${parts['t']}.$body')).toString();
  if (parts['v1'] != expected) throw Exception('Signature invalide');
  return jsonDecode(body);
}