Webhooks

// Node.js — verify Finvex webhook signature
const crypto = require('crypto')

function verifyWebhook(payload, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  )
}

app.post('/webhooks/payos', (req, res) => {
  const sig = req.headers['x-finvex-signature']
  if (!verifyWebhook(req.rawBody, sig, process.env.FINVEX_WEBHOOK_SECRET)) {
    return res.status(401).send('Unauthorized')
  }
  const { event, data } = req.body
  // Handle: payment.captured, subscription.charged, etc.
  res.sendStatus(200)
})