Вебхуки

import crypto from 'node:crypto';
import express from 'express';

const app = express();

// Подпись считается от сырого тела — не парсите JSON до проверки
app.post('/webhooks/donatex', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.DONATEX_WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');
  const received = req.get('X-DonateX-Signature') ?? '';

  const isValid = expected.length === received.length
    && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
  if (!isValid) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString('utf8'));
  handleDonation(event.data);
  res.sendStatus(200); // ответ 2xx останавливает повторы
});

import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)

@app.post("/webhooks/donatex")
def donatex_webhook():
    expected = hmac.new(
        os.environ["DONATEX_WEBHOOK_SECRET"].encode(),
        request.get_data(),
        hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-DonateX-Signature", "")):
        abort(401)

    handle_donation(request.get_json()["data"])
    return "", 200