Receive your first webhook

1. Expose an HTTPS endpoint

Any framework works. The handler must read the raw body before parsing — you need the exact bytes to verify the signature (see signature verification).

app.post('/credicorp/webhooks', express.raw({type:'*/*'}), (req, res) => {
  const sig = req.header('Credicorp-Signature');
  if (!verify(req.body, sig, process.env.WHSEC)) return res.status(400).end();
  const evt = JSON.parse(req.body);
  enqueue(evt);            // do real work async
  res.status(200).end();   // acknowledge within 10s
});

2. Register it

Register the URL and subscribe to the events you care about. See Register a webhook endpoint. Store the returned whsec_ secret in your environment.

3. Verify every delivery

Recompute the HMAC over {t}.{rawbody} and compare in constant time, rejecting anything older than the 300-second tolerance.

4. Acknowledge fast

Return 200 immediately and process asynchronously so you never trip the 10-second timeout.