Webhooks

curl -X POST https://api.nfer.me/v1/webhooks \
  -H "X-API-Key: $NFER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://seu-sistema.com.br/api/webhooks/nfer",
    "events": [
      "nfe.autorizada",
      "nfe.erro",
      "nfe.cancelada",
      "nfe.contingencia"
    ],
    "secret": "sua_chave_secreta_para_validacao_hmac"
  }'

{
  "id": "wh_78a1bc-uuid",
  "url": "https://seu-sistema.com.br/api/webhooks/nfer",
  "events": ["nfe.autorizada", "nfe.erro", "nfe.cancelada", "nfe.contingencia"],
  "active": true,
  "secret": "sua_chave_secreta_para_validacao_hmac",
  "createdAt": "2026-08-20T12:00:00.000Z"
}

import crypto from 'crypto';
import type { Request, Response } from 'express';

export function handleNferWebhook(req: Request, res: Response) {
  const secret = process.env.NFER_WEBHOOK_SECRET || '';
  const signature = req.headers['x-nfer-signature'] as string;
  const timestamp = req.headers['x-nfer-timestamp'] as string;

  // Atenção: Use o raw body (bytes originais da requisição antes do JSON.parse)
  const rawBody = (req as any).rawBody || JSON.stringify(req.body);

  if (secret && signature && timestamp) {
    const payloadToSign = `${timestamp}.${rawBody}`;
    const expectedSignature = 'sha256=' + crypto
      .createHmac('sha256', secret)
      .update(payloadToSign)
      .digest('hex');

    // Comparação em tempo constante para proteção contra timing attacks
    const isValid = crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature)
    );

    if (!isValid) {
      return res.status(401).json({ error: 'Assinatura inválida' });
    }
  }

  const { type, data } = req.body;

  if (type === 'nfe.autorizada') {
    console.log(`Nota ${data.numero} autorizada! Chave: ${data.chaveAcesso}`);
    // Atualize o status do pedido no seu banco de dados
  }

  // Responda sempre 200 OK rapidamente
  return res.status(200).json({ received: true });
}

curl -X POST https://api.nfer.me/v1/webhooks/wh_78a1bc-uuid/test \
  -H "X-API-Key: $NFER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "eventType": "nfe.autorizada",
    "nfeId": "8696e84a-72fe-41aa-bcd5-bb6165ba1ab7"
  }'