Integração HTTP genérica

import express from "express";
import crypto from "node:crypto";

const app = express();
const SECRET = process.env.WABOX_WEBHOOK_SECRET; // whsec_...

function verify(rawBody, header) {
  const parts = Object.fromEntries((header ?? "").split(",").map((p) => p.split("=")));
  if (!parts.t || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = crypto.createHmac("sha256", SECRET).update(`${parts.t}.${rawBody}`).digest("hex");
  if (expected.length !== parts.v1.length) return false;
  return crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(parts.v1, "hex"));
}

// express.raw mantém o corpo como Buffer, sem parse.
app.post("/webhooks/wabox", express.raw({ type: "application/json" }), (req, res) => {
  const raw = req.body.toString("utf8");
  if (!verify(raw, req.get("X-Wabox-Signature"))) return res.status(401).end();

  res.status(200).end(); // responde antes de processar

  const event = JSON.parse(raw);
  setImmediate(() => handleEvent(event)); // ou publique em uma fila
});

async function handleEvent(event) {
  switch (event.type) {
    case "received":
      if (event.from_me || !event.text) return;
      // event.phone, event.text.message, event.message_id, event.event_id
      break;
    case "delivery":
      // event.message_id, event.wabox_id, event.error?, event.error_code?
      break;
  }
}

import hmac, hashlib, time, json
from fastapi import FastAPI, Request, Response, BackgroundTasks
import os

app = FastAPI()
SECRET = os.environ["WABOX_WEBHOOK_SECRET"].encode()  # whsec_...

def verify(raw: bytes, header: str | None) -> bool:
    parts = dict(p.split("=", 1) for p in (header or "").split(",") if "=" in p)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1:
        return False
    if abs(time.time() - int(t)) > 300:
        return False
    expected = hmac.new(SECRET, f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

@app.post("/webhooks/wabox")
async def wabox_webhook(request: Request, background: BackgroundTasks):
    raw = await request.body()  # corpo cru, antes de qualquer parse
    if not verify(raw, request.headers.get("x-wabox-signature")):
        return Response(status_code=401)
    event = json.loads(raw)
    background.add_task(handle_event, event)  # processa depois de responder
    return Response(status_code=200)

def handle_event(event: dict):
    if event["type"] == "received":
        if event.get("from_me") or "text" not in event:
            return
        # event["phone"], event["text"]["message"], event["message_id"]
    elif event["type"] == "delivery":
        # event["message_id"], event.get("error"), event.get("error_code")
        pass

<?php
$secret = getenv('WABOX_WEBHOOK_SECRET'); // whsec_...

$raw = file_get_contents('php://input'); // corpo cru
$header = $_SERVER['HTTP_X_WABOX_SIGNATURE'] ?? '';

$parts = [];
foreach (explode(',', $header) as $p) {
    [$k, $v] = array_pad(explode('=', $p, 2), 2, null);
    $parts[$k] = $v;
}

$valid = isset($parts['t'], $parts['v1'])
    && abs(time() - (int) $parts['t']) <= 300
    && hash_equals(hash_hmac('sha256', $parts['t'] . '.' . $raw, $secret), $parts['v1']);

if (!$valid) {
    http_response_code(401);
    exit;
}

// Responde 200 e libera a conexão antes de processar.
http_response_code(200);
if (function_exists('fastcgi_finish_request')) {
    fastcgi_finish_request();
}

$event = json_decode($raw, true);
if ($event['type'] === 'received' && empty($event['from_me']) && isset($event['text'])) {
    // $event['phone'], $event['text']['message'], $event['message_id']
}

curl -X POST "https://api.wabox.me/instances/{instance_id}/token/{token}/send-text" \
  -H "Content-Type: application/json" \
  -d '{ "phone": "5511988887777", "message": "Olá! Recebemos seu pedido." }'

const BASE = `https://api.wabox.me/instances/${process.env.WABOX_INSTANCE_ID}/token/${process.env.WABOX_TOKEN}`;

async function sendText(phone, message) {
  const res = await fetch(`${BASE}/send-text`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      // "Client-Token": process.env.WABOX_CLIENT_TOKEN, // só se ativado
    },
    body: JSON.stringify({ phone, message }),
  });
  const body = await res.json();
  if (!res.ok) throw Object.assign(new Error(body.error.message), { status: res.status, code: body.error.code, res });
  return body; // { id, message_id, wabox_id, status: "queued" }
}

import os, requests

BASE = f"https://api.wabox.me/instances/{os.environ['WABOX_INSTANCE_ID']}/token/{os.environ['WABOX_TOKEN']}"

def send_text(phone: str, message: str) -> dict:
    r = requests.post(
        f"{BASE}/send-text",
        json={"phone": phone, "message": message},
        # headers={"Client-Token": os.environ["WABOX_CLIENT_TOKEN"]},  # só se ativado
        timeout=15,
    )
    body = r.json()
    if not r.ok:
        raise RuntimeError(f"{r.status_code} {body['error']['code']}: {body['error']['message']}")
    return body  # { id, message_id, wabox_id, status: "queued" }