Verifikacija webhooks

Kako provjeriti autentičnost webhook zahtjeva.

Signature header

Svaki webhook ima X-FiskalAPI-Signature header s HMAC-SHA256 potpisom.

Webhook secret

U dashboardu dobijete webhook secret (whsec_xxx) za verifikaciju.

⚠️ Replay protection

Provjerite timestamp u payloadu — odbijte webhooks starije od 5 minuta.

Verifikacija (Node.js)

import { createHmac } from 'crypto';

function verifyWebhook(payload, signature, secret) {
  const expected = createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return signature === `sha256=${expected}`;
}

// Express middleware
app.post('/webhook', (req, res) => {
  const sig = req.headers['x-fiskalapi-signature'];
  if (!verifyWebhook(req.rawBody, sig, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  // Process webhook...
  res.status(200).send('OK');
});