Seu sistema sabe assim que acontece.

import crypto from 'node:crypto';

// secret: whsec_... da inscrição; body: corpo bruto, sem parse
export function isValidWebhook(headers, body, secret) {
  const id = headers['svix-id'];
  const ts = headers['svix-timestamp'];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    return false;
  }

  const key = Buffer.from(secret.split('_')[1], 'base64');
  const expected = crypto
    .createHmac('sha256', key)
    .update(`${id}.${ts}.${body}`)
    .digest('base64');

  return headers['svix-signature']
    .split(' ')
    .map((entry) => entry.split(',')[1] ?? '')
    .some((signature) => safeEqual(signature, expected));
}

function safeEqual(a, b) {
  return a.length === b.length &&
    crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
}