Webhooks

{"id":"evt_...","type":"payment.paid","version":1,"seller_id":"sel_...","resource_id":"pi_...","created_at":"2026-09-27T12:00:00.000Z","data":{...}}

signed_payload = x-wolf-timestamp + "." + corpo_bruto
x-wolf-signature = "v1=" + hex( HMAC_SHA256( chave = signing_secret, mensagem = signed_payload ) )

signing_secret   = whsec_live_EXEMPLO_nao_use_em_producao
x-wolf-timestamp = 1790510400
corpo_bruto      = {"id":"evt_0000000000000000000000000000abcd","type":"webhook.test","version":1,"seller_id":"sel_exemplo","resource_id":"whe_exemplo","created_at":"2026-09-27T12:00:00.000Z","data":{"endpoint_id":"whe_exemplo","test":true,"message":"Wolf webhook test event."}}
x-wolf-signature = v1=ebf4b0f7f5fff401df7fd114a15c3165ee62668e8f972f5ec6a5cc9454e44c37

import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.WOLF_WEBHOOK_SECRET; // whsec_live_...
const TOLERANCE_SECONDS = 300;

export function verifyWolfSignature(rawBody, timestamp, signature, secret = SECRET, nowSeconds = Date.now() / 1000) {
  if (!/^\d+$/.test(timestamp ?? '')) return false;
  if (Math.abs(nowSeconds - Number(timestamp)) > TOLERANCE_SECONDS) return false;
  const expected = 'v1=' + crypto.createHmac('sha256', secret).update(`${timestamp}.`).update(rawBody).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(signature ?? '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();
// express.raw mantém o corpo como Buffer, exatamente como chegou.
app.post('/wolf/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyWolfSignature(req.body, req.get('x-wolf-timestamp'), req.get('x-wolf-signature'))) return res.sendStatus(400);
  const event = JSON.parse(req.body.toString('utf8'));
  // Idempotência: ignore event.id já processado. Responda 2xx rápido e processe em segundo plano.
  res.sendStatus(204);
});

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

SECRET = os.environ["WOLF_WEBHOOK_SECRET"].encode("utf-8")  # whsec_live_...
TOLERANCE_SECONDS = 300


def verify_wolf_signature(raw_body: bytes, timestamp: str, signature: str, secret: bytes = SECRET) -> bool:
    if not timestamp or not timestamp.isdigit():
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    digest = hmac.new(secret, timestamp.encode("ascii") + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest("v1=" + digest, signature or "")


app = Flask(__name__)


@app.post("/wolf/webhooks")
def wolf_webhook():
    raw_body = request.get_data()  # bytes, antes de qualquer parse de JSON
    if not verify_wolf_signature(raw_body, request.headers.get("x-wolf-timestamp", ""), request.headers.get("x-wolf-signature", "")):
        abort(400)
    event = request.get_json()
    # Idempotência: ignore event["id"] já processado.
    return "", 204

<?php
const TOLERANCE_SECONDS = 300;

function verify_wolf_signature(string $rawBody, string $timestamp, string $signature, string $secret): bool
{
    if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > TOLERANCE_SECONDS) {
        return false;
    }
    $expected = 'v1=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature);
}

$secret = getenv('WOLF_WEBHOOK_SECRET'); // whsec_live_...
$rawBody = file_get_contents('php://input'); // bytes exatos do corpo
$timestamp = $_SERVER['HTTP_X_WOLF_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_WOLF_SIGNATURE'] ?? '';

if (!verify_wolf_signature($rawBody, $timestamp, $signature, $secret)) {
    http_response_code(400);
    exit;
}
$event = json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);
// Idempotência: ignore $event['id'] já processado.
http_response_code(204);