Webhooks

POST /webhooks/tfshop HTTP/1.1
Host: erp.exemplo.com.br
Content-Type: application/json
webhook-id: evt_2Wm9QeR4tY7uI1
webhook-timestamp: 1793279112
webhook-signature: v1,oko9mPul9WX3z0xI398oWm44c9uaHY5FAAL/CR1PWno=

{
  "id": "evt_2Wm9QeR4tY7uI1",
  "type": "order.paid",
  "timestamp": "2026-10-29T13:05:12.000Z",
  "api_version": "v1",
  "store_id": "st_volt",
  "actor": { "type": "system", "app_id": null },
  "data": {
    "object": "order",
    "id": "o_1011",
    "reference": "1011",
    "status": "paid",
    "test": false
  }
}

curl "https://api.tfshop.cloud/v1/events?created_since=2026-10-28T00:00:00Z&type=order.paid&limit=100" \
  -H "Authorization: Bearer $TFSHOP_TOKEN"

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.TFSHOP_WEBHOOK_SECRET; // "whsec_..."
const KEY = Buffer.from(SECRET.slice("whsec_".length), "base64");
const TOLERANCE_S = 5 * 60;

function verify(headers, rawBody /* Buffer */) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatures = headers["webhook-signature"];
  if (!id || !timestamp || !signatures) return false;

  const ts = Number(timestamp);
  const now = Math.floor(Date.now() / 1000);
  if (!Number.isInteger(ts) || Math.abs(now - ts) > TOLERANCE_S) return false;

  const expected = crypto
    .createHmac("sha256", KEY)
    .update(`${id}.${timestamp}.`)
    .update(rawBody)
    .digest();

  return signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const received = Buffer.from(signature, "base64");
    return received.length === expected.length && crypto.timingSafeEqual(received, expected);
  });
}

const app = express();

// express.raw keeps the exact bytes that were signed
app.post("/webhooks/tfshop", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.headers, req.body)) return res.status(401).end();
  const event = JSON.parse(req.body.toString("utf8"));
  // dedupe on event.id (= webhook-id), enqueue, answer fast
  res.status(204).end();
});