Verify HMAC

Every delivery includes X-Webhook-Signature: sha256=<hex> over the raw body using your endpoint signing secret (shown once on create/rotate). Also check X-Webhook-Id and X-Webhook-Timestamp.

const crypto = require("crypto");
function verify(secret, rawBody, header) {
  const want = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(want), Buffer.from(header || ""));
}

import hashlib, hmac
def verify(secret: str, raw_body: bytes, header: str) -> bool:
    want = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(want, header or "")