Generalidades

import hmac
import hashlib
from flask import Flask, request

app = Flask(__name__)
WEBHOOK_SECRET = 'wh_tok_...'

def verify_webhook_signature(signature, payload):
    expected_signature = hmac.new(
        WEBHOOK_SECRET.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected_signature)

@app.route('/webhooks/onepay', methods=['POST'])
def webhook():
    signature = request.headers.get('x-signature')
    payload = request.get_data(as_text=True)

    if not verify_webhook_signature(signature, payload):
        return 'Invalid signature', 401

    data = request.get_json()
    event_type = data['event']['type']
    print(f'Received event: {event_type}')

    # Procesar el evento...

    return 'OK', 200

<?php
$signature = $_SERVER['HTTP_X_SIGNATURE'];
$secret = getenv('ONEPAY_WEBHOOK_SECRET'); // wh_tok_...

// Obtener el body raw
$rawBody = file_get_contents('php://input');

// Calcular la firma esperada
$expectedSignature = hash_hmac('sha256', $rawBody, $secret);

// Comparar de forma segura
if (!hash_equals($expectedSignature, $signature)) {
    http_response_code(401);
    die('Invalid signature');
}

$data = json_decode($rawBody, true);
$eventType = $data['event']['type'];
error_log("Received event: $eventType");

// Procesar el evento...

http_response_code(200);
echo 'OK';
?>