Webhook

import crypto from 'node:crypto';

function verifyWebhook({ apiSecret, timestamp, signature, rawBody }) {
  const expected = crypto
    .createHmac('sha256', apiSecret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  if (expected !== signature) {
    throw new Error('Invalid webhook signature');
  }
}

// const timestamp = req.headers['x-webhook-timestamp'];
// const signature = req.headers['x-webhook-signature'];
// const rawBody = req.rawBody; // string JSON mentah
// verifyWebhook({ apiSecret, timestamp, signature, rawBody });

function verifyWebhook(string $apiSecret, string $timestamp, string $signature, string $rawBody): void {
  $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $apiSecret);
  if (!hash_equals($expected, $signature)) {
    throw new RuntimeException('Invalid webhook signature');
  }
}

import hashlib, hmac

def verify_webhook(api_secret: str, timestamp: str, signature: str, raw_body: str) -> None:
    expected = hmac.new(
        api_secret.encode(),
        f'{timestamp}.{raw_body}'.encode(),
        hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(expected, signature):
        raise ValueError('Invalid webhook signature')

mac := hmac.New(sha256.New, []byte(apiSecret))
mac.Write([]byte(timestamp + "." + rawBody))
expected := hex.EncodeToString(mac.Sum(nil))
if !hmac.Equal([]byte(expected), []byte(signature)) {
  return errors.New("invalid webhook signature")
}