const r = await fetch("{{BASE}}/v1/cobrancas", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + process.env.TPH_CHAVE,
    "Content-Type": "application/json",
    "Idempotency-Key": "pedido-1042"
  },
  body: JSON.stringify({
    valor: 4990,
    metodo: "pix",
    gateway: "auto",
    cliente: { nome: "Ana Souza", documento: "52998224725", email: "ana@email.com" },
    metadata: { pedido: "1042" }
  })
});
const cobranca = await r.json();
// cobranca.pix.copia_e_cola → mostrar pro comprador

$ch = curl_init("{{BASE}}/v1/cobrancas");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer " . getenv("TPH_CHAVE"),
    "Content-Type: application/json",
    "Idempotency-Key: pedido-1042",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "valor" => 4990, "metodo" => "pix", "gateway" => "auto",
    "cliente" => ["nome" => "Ana Souza", "documento" => "52998224725"],
    "metadata" => ["pedido" => "1042"],
  ]),
]);
$cobranca = json_decode(curl_exec($ch), true);

curl {{BASE}}/v1/cobrancas \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: pedido-1042" \
  -d '{"valor":4990,"metodo":"pix","gateway":"auto",
       "cliente":{"nome":"Ana Souza","documento":"52998224725"}}'

{
  "id": "ch_9KdP2xQm4Lw8Tz1B",
  "status": "pendente",
  "valor": 4990,
  "metodo": "pix",
  "gateway": "asaas",
  "gateway_pedido": "auto",
  "ambiente": "producao",
  "estornado": 0,
  "pix": {
    "copia_e_cola": "00020126...",
    "qr_code_base64": "iVBORw0KGgo...",
    "expira_em": "2026-11-09T21:30:00-03:00"
  },
  "metadata": { "pedido": "1042" },
  "criada_em": "2026-11-09T20:30:00.000Z",
  "paga_em": null,
  "tentativas": [
    { "gateway": "asaas", "resultado": "ok", "latencia_ms": 412 }
  ]
}

import crypto from "node:crypto";

// Use o corpo BRUTO (texto), antes do JSON.parse
app.post("/webhooks/pagamentos", express.text({ type: "*/*" }), (req, res) => {
  const partes = Object.fromEntries(req.get("X-Assinatura").split(",").map(p => p.split("=")));
  const esperado = crypto.createHmac("sha256", process.env.TPH_WEBHOOK_SEGREDO)
    .update(partes.t + "." + req.body).digest("hex");
  const recente = Math.abs(Date.now() / 1000 - Number(partes.t)) < 300;
  if (!recente || !crypto.timingSafeEqual(Buffer.from(esperado), Buffer.from(partes.v1))) {
    return res.sendStatus(401);
  }
  const evento = JSON.parse(req.body);
  if (evento.tipo === "cobranca.paga") liberarPedido(evento.dados.metadata.pedido);
  res.sendStatus(200);
});

$corpo = file_get_contents("php://input");
parse_str(str_replace(",", "&", $_SERVER["HTTP_X_ASSINATURA"]), $p);
$esperado = hash_hmac("sha256", $p["t"] . "." . $corpo, getenv("TPH_WEBHOOK_SEGREDO"));
if (abs(time() - (int)$p["t"]) > 300 || !hash_equals($esperado, $p["v1"])) {
  http_response_code(401); exit;
}
$evento = json_decode($corpo, true);
if ($evento["tipo"] === "cobranca.paga") liberarPedido($evento["dados"]["metadata"]["pedido"]);
http_response_code(200);

{
  "id": "ev_7Hq2Lm9TzR4vW8nB",
  "tipo": "cobranca.paga",
  "criado_em": "2026-11-09T20:31:02.000Z",
  "dados": {
    "id": "ch_9KdP2xQm4Lw8Tz1B",
    "status": "paga",
    "valor": 4990,
    "gateway": "asaas",
    "metadata": { "pedido": "1042" }
  }
}