OnlyFans webhooks, signed and retried

import { Webhook } from "standardwebhooks"

const wh = new Webhook(process.env.BFL_WEBHOOK_SECRET!) // whsec_...

export async function POST(req: Request) {
  const body = await req.text()
  let event
  try {
    event = wh.verify(body, Object.fromEntries(req.headers))
  } catch {
    return new Response("Bad signature", { status: 400 })
  }

  if (event.type === "action.pending") {
    // Ping the team: a write is waiting for approval
  }
  return new Response(null, { status: 204 })
}