Webhooks de Reval: recibí los eventos de suscripción en tu servidor

{
  "id": "cmg…",
  "topic": "subscription.cancelled",
  "created_at": "2026-10-16T14:03:11.000Z",
  "shop": "tu-tienda.myshopify.com",
  "subscription_id": "cmg…",
  "data": {
    "subscription_id": "cmg…",
    "status": "cancelled",
    "customer_email": "ana@example.com",
    "customer_first_name": "Ana",
    "product_name": "Café de especialidad 500 g",
    "product_names": "Café de especialidad 500 g",
    "amount": 18500,
    "amount_formatted": "$ 18.500,00",
    "currency": "ARS",
    "frequency": 1,
    "frequency_type": "months",
    "frequency_label": "Mensual",
    "cycle_number": 4,
    "next_payment_date": null,
    "portal_subscription_url": "https://tu-tienda.com/apps/subscriptions/portal?sub=cmg…",
    "source": "customer",
    "reason": "Me voy de viaje"
  }
}

X-Reval-Signature: t=1760623391,v1=5f1c…e9a2

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyReval(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1 ?? "", "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

import hmac, hashlib, time

def verify_reval(raw_body: bytes, header: str, secret: str, tolerance=300) -> bool:
    parts = dict(kv.split("=", 1) for kv in header.split(","))
    t = int(parts.get("t", "0"))
    if not t or abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))