Documentação que funciona.

{
  "eventId": "123e4567-e89b-42d3-a456-426614174001",
  "event": "message.received",
  "timestamp": "2026-10-14T18:00:00.000Z",
  "instanceId": "123e4567-e89b-42d3-a456-426614174002",
  "workspaceId": "123e4567-e89b-42d3-a456-426614174003",
  "payload": {
    "id": "MENSAGEM_DO_WHATSAPP",
    "from": "5545999999999",
    "chatId": "5545999999999@s.whatsapp.net",
    "groupId": null,
    "type": "text",
    "text": "Olá",
    "hasMedia": false
  }
}

import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";
const secret = process.env.SUED_WEBHOOK_SECRET;

createServer(async (req, res) => {
  if (req.method !== "POST" || req.url !== "/webhooks/sued") {
    res.writeHead(404).end(); return;
  }
  const parts = [];
  for await (const chunk of req) parts.push(chunk);
  const raw = Buffer.concat(parts);
  const ts = String(req.headers["x-sued-timestamp"] || "");
  const received = String(req.headers["x-sued-signature"] || "");
  const validTime = /^\d+$/.test(ts) && Math.abs(Date.now()/1000 - Number(ts)) <= 300;
  const expected = "sha256=" + createHmac("sha256", secret)
    .update(ts + "." + raw.toString("utf8")).digest("hex");
  const a = Buffer.from(received), b = Buffer.from(expected);
  if (!validTime || a.length !== b.length || !timingSafeEqual(a, b)) {
    res.writeHead(401).end(); return;
  }
  const event = JSON.parse(raw.toString("utf8"));
  console.log(event.event, event.payload);
  // Deduplicate by X-Sued-Event-Id before processing.
  res.writeHead(200).end();
}).listen(3000); // Publish behind HTTPS