Webhooks assinados e com retentativas

{
  "id": "d4bb36f6-0f8e-4c7a-8ba0-0123456789ab",
  "evento": "pedido_compra.emitido",
  "criado_em": "2026-08-19T16:30:00.000Z",
  "tentativa": 1,
  "data": {
    "pedido": {
      "id": "91513a3e-0b60-43dc-abdf-55611083b387",
      "numero_sequencial": 5,
      "numero_sc": "8",
      "status": "EMITIDO",
      "fornecedor_nome": "Fornecedor Exemplo",
      "valor_total": 1250.50,
      "itens": []
    }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

const timestamp = request.headers.get("x-softbuy-timestamp") ?? "";
const received = request.headers.get("x-softbuy-signature") ?? "";
const rawBody = await request.text();

const expected = "v1=" + createHmac("sha256", process.env.SOFTBUY_WEBHOOK_SECRET!)
  .update(timestamp + "." + rawBody)
  .digest("hex");

const valid = received.length === expected.length &&
  timingSafeEqual(Buffer.from(received), Buffer.from(expected));