Webhook Events

POST https://your-app.com/webhooks/fez
Content-Type: application/json
X-Fez-Signature: sha256=<HMAC-SHA256>
X-Fez-Event: order.created

{
  "event": "order.created",
  "timestamp": "2026-02-27T01:00:00Z",
  "storeId": "store_abc123",
  "data": {
    "id": "order_xyz",
    "total": 299.00,
    "items": [...]
  }
}

const crypto = require("crypto");

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}