// Eventos: payment.confirmed, payment.expired,
//          payment.canceled, payment.error, payment.refunded

// Headers enviados:
// X-Webhook-Signature: hmac-sha256 do body
// X-Webhook-Timestamp: ISO timestamp

// Verificar assinatura (Node.js):
const crypto = require("crypto");
const sig = req.headers["x-webhook-signature"];
const expected = crypto
  .createHmac("sha256", WEBHOOK_SECRET)
  .update(JSON.stringify(req.body))
  .digest("hex");
if (sig === expected) { /* valido */ }

// Payload:
{
  "event": "payment.confirmed",
  "data": {
    "id": "019d5052...",
    "externalId": "pedido_123",
    "status": "depix_sent",
    "amountInCents": 5000,
    "payerName": "JOAO DA SILVA",
    "createdAt": "2026-04-02T19:30:00"
  },
  "timestamp": "2026-04-02T19:31:00Z"
}