Webhooks

{
  "data": { "...": "depends on the event" },
  "event": "PaymentCompleted",
  "timestamp": "2026-10-15T09:30:12.512Z",
  "idempotencyKey": "7qqQL3bE0o8R8d3X"
}

import crypto from 'crypto';
import express from 'express';

const app = express();

app.post('/webhooks/exode', express.raw({ type: 'application/json' }), (req, res) => {
    const rawBody = req.body.toString('utf8');
    const received = req.header('signature') || '';

    const expected = crypto
        .createHmac('sha256', process.env.EXODE_WEBHOOK_SECRET)
        .update(rawBody)
        .digest('hex');

    const isValid = received.length === expected.length
        && crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));

    if (!isValid) {
        return res.status(401).send('invalid signature');
    }

    const payload = JSON.parse(rawBody);

    /* Handle the event and remember payload.idempotencyKey */

    res.sendStatus(200);
});