// Headers que vas a recibir
Content-Type: application/json
User-Agent: CloudWapp-Webhook/1.0
X-CloudWapp-Event: message.received
X-CloudWapp-Delivery: <jobId>
X-CloudWapp-Signature: sha256=<hex>   // si configuraste secret

// Body
{
  "event": "message.received",
  "userId": "...",
  "timestamp": "2026-05-19T...",
  "data": { "accountId":"...", "from":"...", "text":"hola", "waMessageId":"..." }
}

// Verificar firma en Node.js
const sig = req.headers['x-cloudwapp-signature'];
const expected = 'sha256=' + crypto
  .createHmac('sha256', SECRET)
  .update(req.rawBody)
  .digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
  return res.status(401).end();
}