POST /v1/webhooks
{
  "url": "https://yourapp.com/webhooks/tavio",
  "events": ["payment.completed", "payment.failed", "payout.completed", "refund.created"]
}

{
  "id": "evt_abc123",
  "type": "payment.completed",
  "created_at": "2026-02-21T11:00:00Z",
  "data": {
    "payment_id": "pay_xyz789",
    "amount": 10000,
    "currency": "USD",
    "settlement_amount": 99.42,
    "settlement_asset": "USDC",
    "stellar_txn_hash": "a1b2c3d4...",
    "metadata": { "order_id": "ord_789" }
  }
}

const crypto = require("crypto");

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");

  return `sha256=${expected}` === signature;
}