Webhooks Overview

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# In your webhook handler:
# payload = request.body  (raw bytes)
# signature = request.headers["X-Webhook-Signature"]
# secret = "whsec_abc123..."  (from configure response)
# if not verify_webhook(payload, signature, secret):
#     return Response(status_code=401)

const crypto = require("crypto");

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

// In your webhook handler:
// const payload = req.rawBody;  // raw request body string
// const signature = req.headers["x-webhook-signature"];
// const secret = "whsec_abc123...";
// if (!verifyWebhook(payload, signature, secret)) {
//   return res.status(401).send("Invalid signature");
// }