POST https://your-service.example/hooks/zapex
Content-Type: application/json
X-Integration-Signature: <hmac>

{
  "hook": "order.created",
  "payload": {
    "id": 123,
    "pickup_point_id": 1,
    "status_code": "order.created",
    "items": []
  },
  "sent_at": "2026-05-29T12:00:00+00:00"
}

use App\Integrations\Support\IntegrationJsonSigner; // или скопируйте алгоритм

$body = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
$expected = IntegrationJsonSigner::sign($body, $secret);
if (! hash_equals($expected, $_SERVER['HTTP_X_INTEGRATION_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit;
}

import hashlib, hmac, json

def canonical(obj):
    if isinstance(obj, dict):
        return {k: canonical(obj[k]) for k in sorted(obj)}
    if isinstance(obj, list):
        return [canonical(x) for x in obj]
    return obj

def sign(body: dict, secret: str) -> str:
    raw = json.dumps(canonical(body), ensure_ascii=False, separators=(',', ':'))
    return hmac.new(secret.encode(), raw.encode(), hashlib.sha256).hexdigest()