Webhooks

{
  "event": "order.created",
  "event_id": "evt_a1b2c3d4",
  "organization_id": "org_xyz789",
  "data": {
    "id": "ORD-2024-001",
    "product": "Magna",
    "volume_liters": 10000,
    "total_mxn": 225000.00,
    "status": "created"
  },
  "created_at": "2026-03-07T10:00:00Z"
}

import hmac, hashlib, time

def verify_webhook(secret, payload_body, signature, timestamp, tolerance=300):
    """Verify a Cantarell OS webhook signature."""
    now = int(time.time())
    if abs(now - int(timestamp)) > tolerance:
        return False  # Replay attack protection

    signed_content = f"{timestamp}.{payload_body}"
    expected = hmac.new(
        secret.encode(), signed_content.encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# In your webhook handler:
# signature = request.headers["X-Cantarell-Signature-256"]
# timestamp = request.headers["X-Cantarell-Timestamp"]
# is_valid = verify_webhook(secret, request.body, signature, timestamp)