Webhook Integration

import crypto from "crypto";

export function verifyWebhookSignature(
  rawBody: string,
  signature: string,  // from X-Webhook-Signature header
  secret: string,
): boolean {
  // Parse "t=<ms>,v1=<hmac>"
  const parts = Object.fromEntries(
    signature.split(",").map((p) => p.split("=", 2))
  );
  const timestamp = parts["t"];
  const hmac      = parts["v1"];
  if (!timestamp || !hmac) return false;

  // Reject replays older than 5 minutes
  if (Date.now() - Number(timestamp) > 5 * 60 * 1000) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(hmac),
    Buffer.from(expected),
  );
}

import hmac
import hashlib
import time

def verify_webhook_signature(raw_body: bytes, signature: str, secret: str) -> bool:
    """Verify the X-Webhook-Signature header from Leads by Alex."""
    # Parse "t=<ms>,v1=<hmac>"
    parts = dict(p.split("=", 1) for p in signature.split(",") if "=" in p)
    timestamp = parts.get("t")
    received_hmac = parts.get("v1")
    if not timestamp or not received_hmac:
        return False

    # Reject replays older than 5 minutes
    if abs(time.time() * 1000 - int(timestamp)) > 5 * 60 * 1000:
        return False

    signed_payload = f"{timestamp}.{raw_body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode("utf-8"),
        signed_payload.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(received_hmac, expected)

<?php
function verifyWebhookSignature(
    string $rawBody,
    string $signature,
    string $secret
): bool {
    // Parse "t=<ms>,v1=<hmac>"
    $parts = [];
    foreach (explode(',', $signature) as $part) {
        [$k, $v] = explode('=', $part, 2);
        $parts[$k] = $v;
    }
    if (empty($parts['t']) || empty($parts['v1'])) return false;

    // Reject replays older than 5 minutes
    if (abs(microtime(true) * 1000 - (int)$parts['t']) > 5 * 60 * 1000) {
        return false;
    }

    $expected = hash_hmac('sha256', $parts['t'] . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1']);
}