Webhooks

import hashlib
import hmac
import time


def verify(raw_body: bytes, signature_header: str, secret: str, tolerance_s: int = 300) -> bool:
    fields = dict(part.split("=", 1) for part in signature_header.split(","))
    timestamp = fields["t"]
    if abs(time.time() - int(timestamp)) > tolerance_s:
        return False
    expected = hmac.new(secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, fields["v1"])

const crypto = require('crypto');

function verify(rawBody, signatureHeader, secret, toleranceS = 300) {
  const fields = Object.fromEntries(signatureHeader.split(',').map((part) => part.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(fields.t)) > toleranceS) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${fields.t}.`)
    .update(rawBody) // a Buffer with the exact bytes received
    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(fields.v1));
}