Вебхуки

{
  "event": "order.status_changed",
  "event_id": "8f3a2c9e-1b4d-4f7a-9e2c-5b6a8c1d2e3f",
  "timestamp": "2026-03-14T12:34:56.789Z",
  "data": {
    "order_id": "ord-1001",
    "type": "giftcard",
    "status": "completed",
    "previous_status": "processing"
  }
}

{
  "event": "manual_service.chat.message",
  "event_id": "1d2c3b4a-5e6f-7a8b-9c0d-e1f2a3b4c5d6",
  "timestamp": "2026-03-14T12:34:56.789Z",
  "data": {
    "order_id": "ord-1002",
    "type": "manual",
    "message_preview": "Hi! Could you confirm the recipient handle?",
    "message_created_at": "2026-03-14T12:34:55Z"
  }
}

const crypto = require('crypto');

function verifyWebhookSignature(rawBody, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'utf8'),
    Buffer.from(expected, 'utf8')
  );
}

// Usage (Express)
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-webhook-signature'];
  if (!verifyWebhookSignature(req.body.toString(), sig, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  const payload = JSON.parse(req.body.toString());
  // Process payload...
  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook_signature(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# Usage (Flask)
@app.route('/webhook', methods=['POST'])
def webhook():
    raw_body = request.get_data()
    sig = request.headers.get('X-Webhook-Signature', '')
    if not verify_webhook_signature(raw_body, sig, os.environ['WEBHOOK_SECRET']):
        return 'Invalid signature', 401
    payload = request.get_json()
    # Process payload...
    return 'OK', 200