Segurança

npm install standardwebhooks

pip install standardwebhooks

composer require standard-webhooks/standard-webhooks

import express from "express"
import { Webhook } from "standardwebhooks"

const wh = new Webhook(process.env.WEBHOOK_SECRET)
const app = express()

// express.raw: o corpo chega como Buffer, byte a byte como a Zapfy enviou.
app.post("/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  let event
  try {
    event = wh.verify(req.body.toString("utf8"), req.headers)
  } catch {
    return res.status(401).end()
  }

  // ... processe o evento (deduplicando por event.id)
  res.status(200).end()
})

import os

from flask import Flask, abort, request
from standardwebhooks.webhooks import Webhook, WebhookVerificationError

wh = Webhook(os.environ["WEBHOOK_SECRET"])
app = Flask(__name__)


@app.post("/webhooks")
def webhook():
    try:
        event = wh.verify(request.get_data(), dict(request.headers))
    except WebhookVerificationError:
        abort(401)

    # ... processe o evento (deduplicando por event["id"])
    return "", 200

<?php
require __DIR__ . '/vendor/autoload.php';

use StandardWebhooks\Webhook;
use StandardWebhooks\Exception\WebhookVerificationException;

$wh = new Webhook(getenv('WEBHOOK_SECRET'));

$headers = [
    'webhook-id' => $_SERVER['HTTP_WEBHOOK_ID'] ?? null,
    'webhook-timestamp' => $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? null,
    'webhook-signature' => $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? null,
];

try {
    $event = $wh->verify(file_get_contents('php://input'), $headers);
} catch (WebhookVerificationException $e) {
    http_response_code(401);
    exit;
}

// ... processe o evento (deduplicando por $event['id'])
http_response_code(200);