Webhooks

{
  "event": "request.approved",
  "id": "PR-1042",
  "amount": 98700,
  "currency": "THB",
  "approved_at": "2026-10-02T09:14:00+07:00"
}

const expected = hmacSHA256(rawBody, WEBHOOK_SECRET);
if (!timingSafeEqual(expected, header)) return res.status(401).end();