Webhooks de saída

{
  "event": "purchase.approved",
  "id": "hotmart:HP123456789",
  "app_id": "9b1f…",
  "occurred_at": "2026-10-12T10:31:00.000Z",
  "contact": {
    "email": "ana@exemplo.pt",
    "first_name": "Ana",
    "last_name": "Silva",
    "phone": null,
    "consent": true,
    "tags": [
      "cliente"
    ]
  },
  "product_ids": [
    "4c2e…"
  ],
  "lesson_id": null,
  "amount_cents": 9700,
  "currency": "EUR",
  "checkout_url": null,
  "data": {}
}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody: string, header: string | null, secret: string) {
  const expected = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  return !!header && header.length === expected.length &&
    timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}