Get paid every period, from a link.

import crypto from "node:crypto";

// Use the raw request body: the signature covers its exact bytes.
export function verify(rawBody, header, secret) {
  const expected = "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header), b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post("/webhooks/abuna", (req, res) => {
  // For a day after you rotate the secret, the old one signs Signature-Previous.
  const secret = process.env.ABUNA_WEBHOOK_SECRET;
  const ok = ["X-Abuna-Signature", "X-Abuna-Signature-Previous"]
    .some((h) => verify(req.rawBody, req.get(h) ?? "", secret));
  if (!ok) return res.sendStatus(400);

  const event = JSON.parse(req.rawBody);
  if (event.type === "invoice.paid") {
    // Give the customer access for the new period.
  }
  res.sendStatus(200);
});