Webhooks

import hashlib, hmac, time

def verified(secret: str, header: str, body: bytes, tolerance: int = 300) -> bool:
    parts = [p.split("=", 1) for p in header.split(",") if "=" in p]
    t = int(next((v for k, v in parts if k == "t"), "0"))
    expected = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest().encode()
    return abs(time.time() - t) <= tolerance and any(
        hmac.compare_digest(expected, v.encode()) for k, v in parts if k == "v1")  # any v1 may match

import crypto from "node:crypto";

// body: the raw request body as a Buffer (e.g. express.raw({ type: "application/json" }))
export function verified(secret, header, body, tolerance = 300) {
  const parts = header.split(",").filter((p) => p.includes("="))
    .map((p) => [p.slice(0, p.indexOf("=")), p.slice(p.indexOf("=") + 1)]);
  const t = Number(parts.find(([k]) => k === "t")?.[1] ?? 0);
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > tolerance) return false;
  const expected = Buffer.from(
    crypto.createHmac("sha256", secret).update(`${t}.`).update(body).digest("hex"));
  return parts.some(([k, v]) => {  // any v1 may match
    const got = Buffer.from(v);
    return k === "v1" && got.length === expected.length && crypto.timingSafeEqual(got, expected);
  });
}