Track & Positions

npm install axios
# for push modes:
npm install express ws

PODS_API_KEY=your-api-key
WALLET_ADDRESS=0x...
ACTION_ID=65f1a2b3c4d5e6f789012345
PORT=3000

import axios from 'axios'

const pods = axios.create({
  baseURL: 'https://api.pods.finance',
  headers: { 'x-api-key': process.env.PODS_API_KEY, 'Content-Type': 'application/json' }
})

const { data } = await pods.get(`/v2/wallets/${process.env.WALLET_ADDRESS}`, {
  params: { include: 'earn' }
})

data.earn.positions.forEach(position => {
  const p = position.spotPosition
  console.log(position.strategy.id, '→ $' + p.underlyingBalanceUSD)
})
console.log('Total: $' + data.earn.summary.totalUnderlyingBalanceUSD)

async function trackAction (id) {
  const terminal = ['SUCCESS', 'FAILED', 'REFUNDED', 'EXPIRED']
  while (true) {
    const { data: action } = await pods.get(`/actions/${id}`)
    console.log('status:', action.status)
    if (terminal.includes(action.status)) return action.status
    await new Promise(resolve => setTimeout(resolve, 5000))
  }
}

import express from 'express'
import { createHmac, timingSafeEqual } from 'node:crypto'

const SECRET = process.env.WEBHOOK_SIGNING_SECRET // shared secret from Pods
const MAX_AGE_SECONDS = 300 // replay protection
const seenWebhookIds = new Set() // dedupe redelivered webhooks

// v1 HMAC over `${timestamp}.${webhookId}.${rawBody}`, compared timing-safe.
function verifySignature (req) {
  const webhookId = req.get('X-Deframe-Webhook-Id')
  const timestamp = req.get('X-Deframe-Webhook-Timestamp')
  const signatureHeader = req.get('X-Deframe-Webhook-Signature') // "v1=<hex>"
  if (!webhookId || !timestamp || !signatureHeader) return false

  const ageSeconds = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp))
  if (!Number.isFinite(ageSeconds) || ageSeconds > MAX_AGE_SECONDS) return false

  const signedPayload = `${timestamp}.${webhookId}.${req.body.toString('utf8')}`
  const expected = createHmac('sha256', SECRET).update(signedPayload, 'utf8').digest('hex')
  const provided = signatureHeader.replace(/^v1=/, '')
  const a = Buffer.from(expected, 'hex')
  const b = Buffer.from(provided, 'hex')
  return a.length === b.length && timingSafeEqual(a, b)
}

const app = express()

// Raw body so the HMAC matches the exact bytes Deframe signed.
app.post('/webhooks/pods', express.raw({ type: '*/*' }), (req, res) => {
  if (!verifySignature(req)) return res.sendStatus(401)

  const webhookId = req.get('X-Deframe-Webhook-Id')
  if (seenWebhookIds.has(webhookId)) return res.sendStatus(200) // duplicate
  seenWebhookIds.add(webhookId)

  const event = JSON.parse(req.body.toString('utf8'))
  if (event.messageType === 'ACTION_UPDATE') {
    const action = event.data
    console.log('ACTION_UPDATE', action?.id, action?.status)
  }
  res.sendStatus(200)
})

app.listen(process.env.PORT ?? 3000)

import WebSocket from 'ws'

const ws = new WebSocket('wss://api.pods.finance/updates')

ws.on('open', () => {
  ws.send(JSON.stringify({ type: 'subscribe', channel: process.env.WALLET_ADDRESS }))
})

ws.on('message', raw => {
  const event = JSON.parse(raw.toString())
  if (event.type === 'action_update') {
    console.log('action_update', event.action?.id, event.action?.status)
  }
})

node track-and-positions.js positions   # or: track | webhook | ws