Verify a payment webhook signature

1Read the raw body and signature header

Compute the HMAC over the exact bytes you received. Parsing to JSON and re-serializing can reorder keys and break the digest, so capture the raw body before any middleware touches it.

> POST /webhooks/1st-node
> X-Signature: 4f1c...9ab2
> { "invoice": "in_8fK2", "status": "settled", "amount_usd": 49 }

2Recompute the HMAC and compare

HMAC-SHA256 the raw body with your webhook secret, prefix it with sha256= and compare against X-1stNode-Signature in constant time. On any mismatch, return 400 and drop the event — do not credit the order.

const h = crypto.createHmac("sha256", SIGNING_SECRET)
  .update(rawBody).digest("hex");
if (!crypto.timingSafeEqual(Buffer.from(h),
    Buffer.from(req.header("X-Signature")))) return res.status(400).end();

3Act only on verified charge.paid events

Once the signature verifies, check event === 'charge.paid' and status === 'paid', then credit the order. Record the charge id so a redelivery is a no-op — delivery is best-effort and may retry.