Assinatura

import express from 'express'
import crypto from 'node:crypto'

const app = express()

// express.raw preserva o corpo original; express.json() quebraria a verificação
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const assinatura = req.get('x-datafy-signature-256') ?? ''
  const timestamp = req.get('x-datafy-timestamp') ?? ''
  const corpo = req.body.toString('utf8')

  const esperada = 'sha256=' + crypto
    .createHmac('sha256', process.env.DATAFY_WEBHOOK_SECRET)
    .update(`${timestamp}.${corpo}`)
    .digest('hex')

  const a = Buffer.from(assinatura)
  const b = Buffer.from(esperada)
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.sendStatus(401)
  }

  if (Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp)) > 300) {
    return res.sendStatus(401)
  }

  res.sendStatus(200) // responda primeiro
  processarEmSegundoPlano(JSON.parse(corpo))
})

<?php
$corpo      = file_get_contents('php://input'); // corpo cru
$assinatura = $_SERVER['HTTP_X_DATAFY_SIGNATURE_256'] ?? '';
$timestamp  = $_SERVER['HTTP_X_DATAFY_TIMESTAMP'] ?? '';

$esperada = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $corpo, getenv('DATAFY_WEBHOOK_SECRET'));

if (!hash_equals($esperada, $assinatura)) {
    http_response_code(401);
    exit;
}

if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit;
}

http_response_code(200);