Eventos (webhooks firmados)

{
  "id": "evt_3f9a1c0b7d2e4a6f8b1c2d3e",
  "type": "lead.stage_changed",
  "createdAt": "2026-09-29T20:14:05.118Z",
  "organizationId": "cm1…",
  "data": {
    "lead": {
      "id": "cm9k2…",
      "name": "Laura Gómez",
      "email": "[email protected]",
      "phone": "+573001234567",
      "pipeline": { "id": "default", "name": "Ventas" },
      "stage": { "id": "s-visita", "name": "Visita agendada" },
      "assignedTo": { "id": "cm2u…", "name": "Carlos Ruiz", "email": "[email protected]" },
      "tags": ["Torre 2"],
      "createdAt": "2026-09-28T15:04:12.511Z",
      "updatedAt": "2026-09-29T20:14:05.020Z"
    },
    "from": { "id": "CONTACTED", "name": "Contactado" },
    "to": { "id": "s-visita", "name": "Visita agendada" }
  }
}

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.YAVE_WEBHOOK_SECRET; // whsec_…

// Usa el cuerpo CRUDO: si lo parseas y lo vuelves a serializar, la firma no coincide.
app.post("/webhooks/yave", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-Yave-Signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return res.sendStatus(400);

  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${t}.${req.body}`)
    .digest("hex");
  const ok =
    parts.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(parts.v1, "hex"), Buffer.from(expected, "hex"));
  if (!ok) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  // Responde rápido y procesa aparte; ignora ids que ya procesaste.
  queue.push(event);
  res.sendStatus(200);
});

<?php
$secret  = getenv('YAVE_WEBHOOK_SECRET'); // whsec_…
$payload = file_get_contents('php://input'); // cuerpo crudo
$header  = $_SERVER['HTTP_X_YAVE_SIGNATURE'] ?? '';

parse_str(str_replace(',', '&', $header), $parts);
$t = (int) ($parts['t'] ?? 0);
if (!$t || abs(time() - $t) > 300) { http_response_code(400); exit; }

$expected = hash_hmac('sha256', $t . '.' . $payload, $secret);
if (!hash_equals($expected, $parts['v1'] ?? '')) { http_response_code(400); exit; }

$event = json_decode($payload, true);
// … guarda $event['id'] para no procesarlo dos veces
http_response_code(200);

import hashlib, hmac, json, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["YAVE_WEBHOOK_SECRET"].encode()  # whsec_…

@app.post("/webhooks/yave")
def yave():
    payload = request.get_data()  # cuerpo crudo (bytes)
    parts = dict(p.split("=", 1) for p in request.headers.get("X-Yave-Signature", "").split(","))
    t = int(parts.get("t", 0))
    if not t or abs(time.time() - t) > 300:
        abort(400)
    expected = hmac.new(SECRET, f"{t}.".encode() + payload, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, parts.get("v1", "")):
        abort(400)
    event = json.loads(payload)
    # … encola event y deduplica por event["id"]
    return "", 200