Webhooks

const crypto = require('crypto');

function validateWebhook(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('base64');
  
  return signature === expectedSignature;
}

// In your webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-sandbox-signature'];
  const isValid = validateWebhook(req.body, signature, WEBHOOK_SECRET);
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook
  res.status(200).send('OK');
});

import hmac
import hashlib
import base64
import json

def validate_webhook(payload, signature, secret):
    expected_signature = base64.b64encode(
        hmac.new(
            secret.encode(),
            json.dumps(payload).encode(),
            hashlib.sha256
        ).digest()
    ).decode()
    
    return signature == expected_signature

# In your webhook handler
@app.route('/webhook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('x-sandbox-signature')
    is_valid = validate_webhook(request.json, signature, WEBHOOK_SECRET)
    
    if not is_valid:
        return 'Invalid signature', 401
    
    # Process webhook
    return 'OK', 200