Built the way you'd build it.

Content-Type: application/json
PediWave-Event-Id: evt_01J9ZK4B2C3D4E5F6G7H8J9K0M
PediWave-Event-Type: payment_intent.succeeded
PediWave-Delivery-Id: dlv_01J9ZK4C3D4E5F6G7H8J9K0M1N
PediWave-Delivery-Attempt: 1
PediWave-Timestamp: 1759918530
PediWave-Signature: t=1759918530,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

{"id":"evt_01J9ZK4B2C3D4E5F6G7H8J9K0M","object":"event",
 "type":"payment_intent.succeeded","api_version":"2026-10-01",
 "data":{"object":{"id":"pi_01J9ZK3M7Q8R1S2T3U4V5W6X7Y","status":"succeeded",…},
         "previous_attributes":{"status":"processing"}}}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody, header, secret) {
  const parts = header.split(",").map((p) => p.split("="));
  const t = parts.find(([k]) => k === "t")?.[1];
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return parts.some(([k, v]) => k === "v1" && v.length === expected.length &&
    timingSafeEqual(Buffer.from(v), Buffer.from(expected)));
}

import hmac, hashlib, time

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = [p.split("=", 1) for p in header.split(",")]
    t = next((v for k, v in parts if k == "t"), None)
    if t is None or abs(time.time() - int(t)) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return any(k == "v1" and hmac.compare_digest(v, expected) for k, v in parts)

app.post("/webhooks/pediwave", express.raw({ type: "application/json" }), (req, res) => {
  const event = pediwave.webhooks.constructEvent(
    req.body, req.get("PediWave-Signature"), process.env.PEDIWAVE_WEBHOOK_SECRET);
  if (event.type === "payment_intent.succeeded") fulfil(event.data.object.reference);
  res.sendStatus(200);
});