Guia de Webhooks

import hashlib
import hmac
import os
import time

CAKTO_WEBHOOK_SECRET = os.environ["CAKTO_WEBHOOK_SECRET"]
TOLERANCE_SECONDS = 5 * 60


def is_from_cakto(raw_body: bytes, timestamp: str, signature: str) -> bool:
    # Rejeita entrega antiga: sem isso, um payload capturado pode ser reenviado depois
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False

    expected = hmac.new(
        CAKTO_WEBHOOK_SECRET.encode("utf-8"),
        f"{timestamp}.".encode("utf-8") + raw_body,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(signature, f"v1={expected}")

import crypto from 'node:crypto';

const SECRET = process.env.CAKTO_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 5 * 60;

// express.raw({ type: 'application/json' }) preserva os bytes originais
function isFromCakto(rawBody, timestamp, signature) {
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) {
    return false;
  }

  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest('hex');

  const a = Buffer.from(signature);
  const b = Buffer.from(`v1=${expected}`);

  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac
import os

CAKTO_WEBHOOK_SECRET = os.environ["CAKTO_WEBHOOK_SECRET"]

def handle_webhook(payload: dict):
    received = payload.get("secret", "")

    # compare_digest evita vazar informação por tempo de comparação
    if not hmac.compare_digest(received, CAKTO_WEBHOOK_SECRET):
        return 401, "unauthorized"

    event = payload["event"]
    data = payload["data"]
    # ... processe o evento
    return 200, "ok"

import crypto from 'node:crypto';

const SECRET = process.env.CAKTO_WEBHOOK_SECRET;

function isFromCakto(received = '') {
  const a = Buffer.from(received);
  const b = Buffer.from(SECRET);
  // timingSafeEqual exige buffers do mesmo tamanho
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post('/webhooks/cakto', (req, res) => {
  if (!isFromCakto(req.body.secret)) {
    return res.status(401).send('unauthorized');
  }

  const { event, data } = req.body;
  // ... processe o evento
  res.sendStatus(200);
});