Webhook

const crypto = require('crypto')

function validarWebhook(req, secret) {
  const assinatura = req.headers['x-campeao-signature']
  if (!assinatura) return false

  const body = JSON.stringify(req.body) // use raw body, não parsed
  const esperado = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body, 'utf8')
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(assinatura),
    Buffer.from(esperado)
  )
}

// Express
app.post('/webhook/kyc', express.raw({ type: 'application/json' }), (req, res) => {
  const body = req.body.toString('utf8')
  const esperado = 'sha256=' + crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(body)
    .digest('hex')

  if (!crypto.timingSafeEqual(Buffer.from(req.headers['x-campeao-signature']), Buffer.from(esperado))) {
    return res.status(401).send('Assinatura inválida')
  }

  const evento = JSON.parse(body)
  // processar evento...
  res.status(200).send('OK')
})

import hashlib
import hmac
from fastapi import Request, HTTPException

async def validar_webhook(request: Request, secret: str) -> dict:
    body = await request.body()
    assinatura = request.headers.get('x-campeao-signature', '')

    esperado = 'sha256=' + hmac.new(
        secret.encode('utf-8'),
        body,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(assinatura, esperado):
        raise HTTPException(status_code=401, detail='Assinatura inválida')

    return json.loads(body)

# FastAPI
@app.post('/webhook/kyc')
async def webhook_kyc(request: Request):
    evento = await validar_webhook(request, os.environ['WEBHOOK_SECRET'])
    # processar evento...
    return {'ok': True}

function validarWebhook($payload, $assinatura, $secret) {
    $esperado = 'sha256=' . hash_hmac('sha256', $payload, $secret);
    return hash_equals($esperado, $assinatura);
}

$payload    = file_get_contents('php://input');
$assinatura = $_SERVER['HTTP_X_CAMPEAO_SIGNATURE'] ?? '';
$secret     = getenv('WEBHOOK_SECRET');

if (!validarWebhook($payload, $assinatura, $secret)) {
    http_response_code(401);
    exit('Assinatura inválida');
}

$evento = json_decode($payload, true);
// processar evento...
http_response_code(200);
echo 'OK';