Webhook

{
  "id": "evt_3f9c…",
  "type": "payment.paid",
  "created_at": "2026-11-08T14:02:11Z",
  "data": {
    "entity_type": "payment",
    "entity_id": "a93e…",
    "title": "Pagamento confirmado",
    "object": {
      "id": "a93e…",
      "amount": 1500,
      "currency": "BRL",
      "status": "paid"
    }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}