Webhooks

{
  "id": "clxxx_delivery",
  "event": "payment.paid",
  "createdAt": "2026-05-24T12:00:00.000Z",
  "data": {
    "id": "clx_transacao",
    "type": "PIX_IN",
    "status": "COMPLETED",
    "amount": 100,
    "feeAmount": 8.5,
    "netAmount": 91.5,
    "currency": "BRL",
    "externalReference": "pedido-123",
    "referenceId": "ref_pix_abc",
    "endToEndId": "E12345678202505301234567890123456",
    "completedAt": "2026-05-24T12:00:00.000Z",
    "createdAt": "2026-05-24T11:55:00.000Z"
  }
}

Content-Type: application/json
x-goatpay-event: payment.paid
x-goatpay-signature: sha256=<hmac do corpo JSON>
x-goatpay-delivery: <id da entrega>

import crypto from "node:crypto";

export function verifyGoatPayWebhook(
  rawBody: string | Buffer,
  signatureHeader: string | undefined,
  webhookSecret: string,
): boolean {
  if (!signatureHeader?.startsWith("sha256=")) return false;
  const received = signatureHeader.slice("sha256=".length);
  const expected = crypto
    .createHmac("sha256", webhookSecret)
    .update(typeof rawBody === "string" ? rawBody : Buffer.from(rawBody))
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(received, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const deliveryId = req.body.id;
if (await alreadyProcessed(deliveryId)) {
  return res.status(200).json({ ok: true });
}
await processEvent(req.body);
await markProcessed(deliveryId);
return res.status(200).json({ ok: true });

{
  "sessionId": "clx_session",
  "status": "PAID",
  "method": "CARD",
  "amount": 99.9,
  "feeAmount": 5.15,
  "netAmount": 94.75,
  "currency": "BRL",
  "transactionId": "clx_tx",
  "externalReference": "pedido-42",
  "paidAt": "2026-06-02T15:00:00.000Z",
  "payer": {
    "name": "Maria",
    "email": "maria@email.com"
  },
  "paymentLink": {
    "id": "clx_link",
    "name": "Plano Pro",
    "slug": "plano-pro",
    "publicCode": "abc12"
  }
}