Desenvolva com a ZAS.

{
  "eventId": "evento-unico-do-parceiro",
  "discordId": "ID_DISCORD_DO_MEMBRO",
  "steamId": "STEAMID64_DO_MESMO_MEMBRO",
  "kind": "activity",
  "seq": 1,
  "expiresAt": 0
}

signingKey = SHA256(secret) em bytes
message = keyId + '\n' + timestamp + '\n' + nonce + '\n' + rawBody
signature = HMAC-SHA256(signingKey, message) em hexadecimal

import { createHash, createHmac, randomBytes } from 'node:crypto';

// Configure estas variáveis somente no backend do parceiro.
const baseUrl = new URL(process.env.ZAS_BASE_URL);
const keyId = process.env.ZAS_PARTNER_ID;
const secret = process.env.ZAS_PARTNER_SECRET;
if (baseUrl.protocol !== 'https:' || baseUrl.username || baseUrl.password
    || !keyId || !secret) throw new Error('Configure o acesso aprovado.');

export function prepareEvent({ eventId, discordId, steamId, seq }) {
  // seq deve vir de um contador persistente e atômico por parceiro.
  const timestamp = String(Math.floor(Date.now() / 1000));
  const nonce = randomBytes(24).toString('base64url');
  const rawBody = JSON.stringify({
    eventId, discordId, steamId, kind: 'activity', seq,
    expiresAt: Number(timestamp) + 120,
  });
  const signingKey = createHash('sha256').update(secret, 'utf8').digest();
  const message = [keyId, timestamp, nonce, rawBody].join('\n');
  const signature = createHmac('sha256', signingKey)
    .update(message, 'utf8').digest('hex');
  return {
    rawBody,
    headers: {
      'Content-Type': 'application/json',
      'x-zas-key': keyId,
      'x-zas-timestamp': timestamp,
      'x-zas-nonce': nonce,
      'x-zas-signature': signature,
    },
  };
}

export async function sendSavedEnvelope(envelope) {
  // Salve o envelope antes do envio; retries reutilizam os mesmos bytes.
  const response = await fetch(new URL('/api/partners/v1/events', baseUrl), {
    method: 'POST', redirect: 'error',
    headers: envelope.headers, body: envelope.rawBody,
    signal: AbortSignal.timeout(10_000),
  });
  const data = await response.json();
  if (!response.ok || data.ok !== true) {
    throw new Error('Evento não confirmado. HTTP ' + response.status);
  }
  return data.result;
}