Webhooks

{
  "id": "0198c7b2-5d1e-7a3c-9e44-2f6a1c0b8d37",
  "type": "invoice.paid",
  "createdAt": "2026-10-25T14:32:08.114Z",
  "data": {
    "invoiceId": "0198c7b1-0a52-7c10-8b7e-4d9f3a21c6e5",
    "orderId": "0198c7b0-e3f4-7d28-a1b6-90c5d8e7f412",
    "totalCents": "4990",
    "currency": "BRL",
    "paidAt": "2026-10-25T14:32:07.902Z"
  }
}

POST /seu-endpoint HTTP/1.1
Content-Type: application/json
User-Agent: Vixpi-Webhooks/1
X-Vixpi-Event: invoice.paid
X-Vixpi-Delivery: 0198c7b2-5d1e-7a3c-9e44-2f6a1c0b8d37
X-Vixpi-Signature: t=<unix>,v1=<hmac-sha256 em hexadecimal>

import { createHmac, timingSafeEqual } from 'node:crypto'

const TOLERANCE_SECONDS = 300

// rawBody: o corpo EXATO recebido (string), antes de qualquer JSON.parse
export function verifyVixpiSignature(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')))
  const t = Number(parts.t)
  if (!parts.v1 || !Number.isInteger(t)) return false
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false

  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(parts.v1)
  return a.length === b.length && timingSafeEqual(a, b)
}

// Express: use express.raw({ type: 'application/json' }) nesta rota
app.post('/webhooks/vixpi', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body.toString('utf8')
  if (!verifyVixpiSignature(raw, req.get('X-Vixpi-Signature') ?? '', process.env.VIXPI_WEBHOOK_SECRET)) {
    return res.sendStatus(400)
  }
  const event = JSON.parse(raw)
  // trate event.type; se já viu event.id, ignore
  res.sendStatus(200)
})

import hashlib
import hmac
import os
import time

TOLERANCE_SECONDS = 300


def verify_vixpi_signature(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(part.split("=", 1) for part in header.split(","))
    try:
        t = int(parts["t"])
        received = parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > TOLERANCE_SECONDS:
        return False

    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received)


# Flask
@app.post("/webhooks/vixpi")
def vixpi_webhook():
    raw = request.get_data()  # bytes originais, sem request.json
    header = request.headers.get("X-Vixpi-Signature", "")
    if not verify_vixpi_signature(raw, header, os.environ["VIXPI_WEBHOOK_SECRET"]):
        return "", 400
    event = request.get_json()
    return "", 200