await fetch('https://api.engineapi.com.br/webhooks', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    url: 'https://seusite.com/webhooks/engine',
    events: ['invoice.authorized', 'invoice.rejected', 'certificate.expiring_soon'],
    secret: 'meu-segredo-hmac',
  }),
});

httpx.post(
    'https://api.engineapi.com.br/webhooks',
    headers={'Authorization': f'Bearer {token}'},
    json={
        'url': 'https://seusite.com/webhooks/engine',
        'events': ['invoice.authorized', 'invoice.rejected', 'certificate.expiring_soon'],
        'secret': 'meu-segredo-hmac',
    },
)

import hashlib
import hmac
import os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.post('/webhooks/engine')
async def handle_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get('x-engineapi-signature', '')
    secret = os.environ['WEBHOOK_SECRET'].encode()
    
    # Calcular HMAC esperado
    expected = 'sha256=' + hmac.new(secret, body, hashlib.sha256).hexdigest()
    
    # Comparação segura
    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=401, detail='Assinatura inválida')
    
    import json
    payload = json.loads(body)
    event_id = payload['id']
    event = payload['event']
    data = payload['data']
    
    # Processar evento
    await process_event(event_id, event, data)
    
    return {'received': True}

@app.post('/webhooks/engine')
async def handle_webhook(request: Request):
    # ... validação HMAC acima ...
    
    payload = json.loads(body)
    event_id = payload['id']
    event = payload['event']
    data = payload['data']
    
    # Idempotência
    if await is_already_processed(event_id):
        return {'received': True}
    
    if event == 'invoice.authorized':
        await db.invoices.update(data['id'], status='AUTHORIZED')
        await notify_customer(data['id'])
    
    elif event == 'invoice.rejected':
        await db.invoices.update(data['id'], status='REJECTED')
        await alert_support(data)
    
    elif event == 'certificate.expiring_soon':
        await send_email(
            to='admin@empresa.com',
            subject='Certificado vencendo em 30 dias',
        )
    
    await mark_as_processed(event_id)
    return {'received': True}