const crypto = require('crypto');
function verificarWebhook(payload, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(JSON.stringify(payload))
.digest('hex');
return signature === expected;
}
app.post('/webhook', (req, res) => {
const signature = req.headers['x-horneross-signature'];
if (!verificarWebhook(req.body, signature, process.env.WEBHOOK_SECRET)) {
return res.status(401).send('Firma inválida');
}
// Procesar evento
console.log('Evento:', req.body.type);
res.status(200).send('OK');
});