app.post('/webhooks/khaime', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-khaime-signature'];
  const rawBody = req.body.toString();
  const payload = JSON.parse(rawBody);

  // 1. Verify signature (use raw body, not re-serialized)
  const expected = crypto
    .createHmac('sha256', process.env.KHAIME_WEBHOOK_SECRET)
    .update(rawBody)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('Invalid signature');
  }

  // 2. Check for duplicate using event_id
  if (await isDuplicate(payload.event_id)) {
    return res.status(200).send('Already processed');
  }

  // 3. Acknowledge immediately
  res.status(200).send('OK');

  // 4. Process asynchronously
  processEvent(payload);
});

@app.route('/webhooks/khaime', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Khaime-Signature')
    raw_body = request.get_data(as_text=True)
    payload = json.loads(raw_body)

    # Verify using raw body
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        raw_body.encode(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)

    # Process
    handle_event(payload)
    return '', 200

add_action('rest_api_init', function() {
    register_rest_route('khaime/v1', '/webhook', [
        'methods' => 'POST',
        'callback' => 'handle_khaime_webhook',
    ]);
});

function handle_khaime_webhook($request) {
    $signature = $request->get_header('X-Khaime-Signature');
    $raw_body = $request->get_body();
    $payload = json_decode($raw_body, true);

    $expected = hash_hmac('sha256', $raw_body, WEBHOOK_SECRET);

    if (!hash_equals($expected, $signature)) {
        return new WP_Error('invalid_signature', '', ['status' => 401]);
    }

    // Process event...
    return new WP_REST_Response(['status' => 'ok'], 200);
}