Configuração e assinatura

const crypto = require("crypto");
const express = require("express");

const app = express();
const SECRET = process.env.ZAZZ_WEBHOOK_SECRET;

// Importante: use o corpo BRUTO (raw), não o objeto já parseado
app.post("/webhook/zazz", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.header("X-Webhook-Signature") || "";
  const timestamp = req.header("X-Webhook-Timestamp") || "";

  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", SECRET)
      .update(`${timestamp}.${req.body.toString("utf8")}`)
      .digest("hex");

  const valid =
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

  if (!valid) return res.status(401).send("invalid signature");

  const event = JSON.parse(req.body.toString("utf8"));
  // ...processe o evento...

  res.sendStatus(200);
});

import hashlib
import hmac
import os

from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["ZAZZ_WEBHOOK_SECRET"].encode()

@app.post("/webhook/zazz")
def zazz_webhook():
    signature = request.headers.get("X-Webhook-Signature", "")
    timestamp = request.headers.get("X-Webhook-Timestamp", "")

    payload = timestamp.encode() + b"." + request.get_data()
    expected = "sha256=" + hmac.new(SECRET, payload, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(signature, expected):
        return "invalid signature", 401

    event = request.get_json()
    # ...processe o evento...
    return "", 200