信頼性が高く、署名され、追跡可能なイベント。

import { createHmac, timingSafeEqual } from "node:crypto";

const signed = `${timestamp}.${rawBody}`;
const expected = createHmac("sha256", process.env.ACHADU_WEBHOOK_SECRET)
  .update(signed)
  .digest("hex");
const received = signature.replace("sha256=", "");

if (!timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
  throw new Error("Invalid signature");
}