Webhooks

<?php
  $payload = file_get_contents('php://input');
  $secret = 'WEBHOOK_SECRET'; // replace with your webhook secret, you can find it by clicking the URL on webhooks page
  $header_signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE']; // get our signature header
  $signature = hash_hmac('sha512', $payload, $secret);

  if (hash_equals($signature, $header_signature)) {
    // handle valid webhook
  } else {
    // invalid webhook
  }
?>

const express = require('express');
const crypto = require('crypto'); // make sure to run this command on your system - npm install express
const app = express();

const HOOK_SECRET = Buffer.from('WEBHOOK_SECRET'); // replace with your webhook secret, you can find it by clicking the URL on webhooks page

app.use(express.raw({ type: '*/*' }));

function verifySignature(body, signature) {
    const hmac = crypto.createHmac('sha512', HOOK_SECRET);
    hmac.update(body);
    const computed = hmac.digest('hex');

    const sigBuffer = Buffer.from(signature, 'hex');
    const computedBuffer = Buffer.from(computed, 'hex');
    if (sigBuffer.length !== computedBuffer.length) return false;
    return crypto.timingSafeEqual(sigBuffer, computedBuffer);
}

app.post('/protected', (req, res) => {
    const clientSignature = req.headers['x-webhook-signature'] || '';
    if (!verifySignature(req.body, clientSignature)) {
        return res.sendStatus(401);
    }
    res.json({ status: 'success' });
});

app.listen(5000, () => {
    console.log('Server running on port 5000');
});

from flask import Flask, request, abort, jsonify # make sure to run this command on your system - pip install flask
import hmac
import hashlib
import os

app = Flask(__name__)
HOOK_SECRET = b"WEBHOOK_SECRET" # replace with your webhook secret, you can find it by clicking the URL on webhooks page

def verify_signature(body, signature):
    computed = hmac.new(HOOK_SECRET, body, digestmod=hashlib.sha512).hexdigest()
    # Use hmac.compare_digest for secure time comparison
    return hmac.compare_digest(signature, computed)

@app.route('/protected', methods=['POST'])
def protected():
    client_signature = request.headers.get('X-Webhook-Signature', '')
    body = request.get_data()
    if not verify_signature(body, client_signature):
        abort(401)
    return jsonify({"status": "success"})

if __name__ == '__main__':
    app.run(debug=True)