async function signPayload(body, secret) {
  const key = await crypto.subtle.importKey(
    'raw', new TextEncoder().encode(secret),
    { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
  );
  const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(body));
  return Array.from(new Uint8Array(sig)).map(b => b.toString(16).padStart(2,'0')).join('');
}

$signature = hash_hmac('sha256', $body, $api_secret);

{
  "event":    "order.created",
  "order_id": "12345",
  "customer": {
    "name":  "Adaeze Okonkwo",
    "phone": "08012345678",
    "email": "adaeze@example.com"
  },
  "shipping": {
    "address_1":   "45 Adeola Odeku",
    "city":        "Lagos",
    "state":       "Lagos",
    "country":     "NG",
    "shipping_fee": 3500
  },
  "notes": "Call before delivery"
}

// 201 Created
{ "success": true, "order_code": "GF-4821" }

// 401 Unauthorized
"Unauthorized"

const crypto = require('crypto');

async function sendToGoFlow(order) {
  const payload = {
    event: 'order.created', order_id: String(order.id),
    customer: { name: order.name, phone: order.phone, email: order.email },
    shipping: { address_1: order.address, city: order.city, state: order.state, country: 'NG', shipping_fee: order.fee },
    notes: order.notes || ''
  };
  const body = JSON.stringify(payload);
  const sig  = crypto.createHmac('sha256', process.env.GOFLOW_SECRET).update(body).digest('hex');
  const res  = await fetch('https://zudjllgouthpgoljklqk.supabase.co/functions/v1/woocommerce-webhook', {
    method: 'POST', headers: { 'Content-Type': 'application/json', 'X-GoFlow-Signature': sig }, body
  });
  return res.json(); // { success: true, order_code: 'GF-4821' }
}

$body      = json_encode($payload);
$signature = hash_hmac('sha256', $body, getenv('GOFLOW_SECRET'));
$ch = curl_init('https://zudjllgouthpgoljklqk.supabase.co/functions/v1/woocommerce-webhook');
curl_setopt_array($ch, [
  CURLOPT_POST => true, CURLOPT_POSTFIELDS => $body, CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-GoFlow-Signature: '.$signature]
]);
$result = json_decode(curl_exec($ch), true);