Webhooks

{
  "id": "delivery_abc123",
  "event": "order.paid",
  "created": "2026-08-20T10:30:00.000Z",
  "data": {
    "…": "event-specific payload"
  }
}

import crypto from 'crypto';

function verify(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    header.split(',').map(p => p.split('='))
  );
  const timestamp = parseInt(parts.t, 10);
  const received = parts.v1;
  if (!timestamp || !received) return false;

  // Reject anything outside the tolerance window, so a captured
  // request cannot be replayed later.
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > toleranceSeconds) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(received),
    Buffer.from(expected)
  );
}