An API you've already written against.

npm install openai

import OpenAI from "openai";
const client = new OpenAI({
  apiKey: process.env.ACORN_API_KEY,
  baseURL: "https://api.acorncompute.com/v1",
});

# Every route accepts Bearer auth.
curl https://api.acorncompute.com/api/v1/models \
  -H "Authorization: Bearer $ACORN_API_KEY"

# OpenAI-compatible: upload a local file, get the transcript back inline.
curl https://api.acorncompute.com/v1/audio/transcriptions \
  -H "Authorization: Bearer $ACORN_API_KEY" \
  -F file="@interview.mp3" \
  -F model="whisper-large-v3" \
  -F response_format="verbose_json"

import { createHmac, timingSafeEqual } from "node:crypto";

const MAX_SKEW = 300;  // reject deliveries outside the five-minute replay window

app.post("/hooks/acorn", express.raw({ type: "*/*" }), (req, res) => {
  const ts = req.headers["x-acorn-timestamp"];
  // Reject stale/replayed timestamps before comparing the signature.
  if (Math.abs(Date.now() / 1000 - Number(ts)) > MAX_SKEW) {
    return res.status(401).end();
  }
  const sig = String(req.headers["x-acorn-signature"]).replace(/^sha256=/, "");
  const expected = createHmac("sha256", process.env.ACORN_WEBHOOK_SECRET)
    .update(ts + ".").update(req.body).digest("hex");
  if (sig.length !== expected.length ||
      !timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(401).end();
  }
  const event = JSON.parse(req.body);
  if (event.status === "completed") enqueue(event.job_id);
  res.status(204).end();
});