Webhook operations

import crypto from "node:crypto";

export function verifyEvent(rawBody, signature, secret) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

​

Handler checklist

• Capture the raw body before JSON parsing.
• Validate the signature, timestamp, and endpoint secret.
• Reject malformed or unauthorized requests.
• Insert the event ID into a unique store before applying effects.
• Queue long-running work and acknowledge quickly.
• Record processing outcome and last error.
• Retry transient failures without replaying a financial transition.
• Alert on repeated failures and stale event backlog.

​

Reconciliation