Webhooks

import crypto from 'crypto';

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'] as string;
  const expected  = `sha256=${crypto
    .createHmac('sha256', process.env.ALPA_WEBHOOK_SECRET!)
    .update(req.body)
    .digest('hex')}`;

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).json({ error: 'Assinatura inválida' });
  }

  const event = JSON.parse(req.body.toString());
  // processar event.type ...
  res.json({ received: true });
});

import hmac, hashlib, os
from flask import Flask, request, jsonify

@app.route('/webhook', methods=['POST'])
def webhook():
    sig      = request.headers.get('x-webhook-signature', '')
    expected = 'sha256=' + hmac.new(
        os.getenv('ALPA_WEBHOOK_SECRET').encode(),
        request.data, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(sig, expected):
        return jsonify(error='Assinatura inválida'), 401
    event = request.json
    return jsonify(received=True)

$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$expected  = 'sha256=' . hash_hmac('sha256', $payload, $_ENV['ALPA_WEBHOOK_SECRET']);
if (!hash_equals($expected, $signature)) {
    http_response_code(401); exit;
}
$event = json_decode($payload, true);