Webhooks

import crypto from 'node:crypto'
import express from 'express'

const app = express()

// express.raw mantém o corpo exatamente como chegou
app.post('/webhooks/deliveryvip', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto.createHmac('sha256', process.env.CLIENT_SECRET).update(req.body).digest('hex')
  const received = req.get('X-App-Signature') ?? ''

  const valid =
    received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected))

  if (!valid) return res.sendStatus(401)

  const event = JSON.parse(req.body)
  queue.push(event) // processe depois, fora da requisição
  res.sendStatus(200)
})

import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)

@app.post("/webhooks/deliveryvip")
def deliveryvip_webhook():
    raw_body = request.get_data()  # bytes exatamente como chegaram
    expected = hmac.new(os.environ["CLIENT_SECRET"].encode(), raw_body, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, request.headers.get("X-App-Signature", "")):
        abort(401)

    queue.put(request.get_json())  # processe depois, fora da requisição
    return "", 200

expected = OpenSSL::HMAC.hexdigest("SHA256", client_secret, request.raw_post)
valid = ActiveSupport::SecurityUtils.secure_compare(expected, request.headers["X-App-Signature"].to_s)

{
  "eventId": "209c060f-41f2-4420-81ab-15f2b5559c58",
  "createdAt": "2026-06-30T12:00:00-03:00",
  "merchantId": "8158198a-4bb7-430e-9746-87cd02dfedda",
  "eventType": "CREATED",
  "orderId": "52122852-6626-11ed-9022-0242ac120002",
  "orderURL": "https://api.deliveryvip.com.br/merchant/v3/orders/52122852-6626-11ed-9022-0242ac120002",
  "orderType": "DELIVERY"
}

{
  "eventId": "6f1d2c3b-8a4e-4b5f-9c6d-7e8f9a0b1c2d",
  "createdAt": "2026-06-30T20:15:00-03:00",
  "merchantId": "8158198a-4bb7-430e-9746-87cd02dfedda",
  "eventType": "CALL_WAITER",
  "placeName": "Mesa 10",
  "placeId": "a3c1e5f7-2b4d-4f6a-8c0e-1d3f5a7b9c2e"
}