Webhooks

Cada evento se firma con HMAC-SHA256 usando tu signing secret.

Headers

Header	Valor
`X-StarCore-Signature`	`sha256=<hex>` — HMAC del cuerpo firmado
`X-StarCore-Timestamp`	Unix seconds del envío
`X-StarCore-Event-Type`	ej. `ecf.approved`
`X-StarCore-Delivery-Id`	UUID único del intento

Validación

Payload a firmar: <timestamp>.<body raw>.

import crypto from 'crypto';

function verify(body, timestamp, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${body}`)
    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Retries

Backoff exponencial: 1, 5, 15, 60, 360, 1440 minutos. Después de 6 intentos → permanently_failed.

Eventos disponibles

ecf.emitted
ecf.approved
ecf.rejected
invoice.paid
invoice.payment_failed
subscription.created
subscription.updated
subscription.canceled
usage.threshold_reached