Webhooks

import hmac, hashlib

def verify_webhook(raw_body: bytes, headers: dict, secrets: list[str]) -> bool:
    ts  = headers["X-WEBHOOK-TIMESTAMP"]   # "2026-09-02T12:34:56.789Z"
    sig = headers["X-WEBHOOK-SIGNATURE"]   # 128 lowercase hex chars
    signed = ts.encode("utf-8") + b"." + raw_body
    for secret in secrets:                 # current, plus previous during rotation
        expected = hmac.new(secret.encode("utf-8"), signed, hashlib.sha512).hexdigest()
        if hmac.compare_digest(expected, sig):
            return True
    return False

const crypto = require('crypto');

// rawBody MUST be the raw Buffer, not a parsed-and-restringified object.
function verifyWebhook(rawBody, headers, secrets) {
  const ts  = headers['x-webhook-timestamp'];
  const sig = headers['x-webhook-signature'];
  if (!ts || !sig) return false;

  const signed = Buffer.concat([Buffer.from(ts, 'utf8'), Buffer.from('.'), rawBody]);
  const given  = Buffer.from(sig, 'utf8');

  return secrets.some((secret) => {
    const expected = Buffer.from(
      crypto.createHmac('sha512', secret).update(signed).digest('hex'), 'utf8');
    return expected.length === given.length &&
           crypto.timingSafeEqual(expected, given);
  });
}

// Express: capture the raw body before any JSON parsing.
// app.use('/webhooks/endl', express.raw({ type: 'application/json' }));

package webhooks

import (
	"crypto/hmac"
	"crypto/sha512"
	"encoding/hex"
	"net/http"
)

// rawBody must be the bytes exactly as received.
func Verify(rawBody []byte, h http.Header, secrets []string) bool {
	ts := h.Get("X-WEBHOOK-TIMESTAMP")
	sig := h.Get("X-WEBHOOK-SIGNATURE")
	if ts == "" || sig == "" {
		return false
	}

	signed := append(append([]byte(ts), '.'), rawBody...)

	for _, secret := range secrets { // current, plus previous during rotation
		mac := hmac.New(sha512.New, []byte(secret))
		mac.Write(signed)
		expected := hex.EncodeToString(mac.Sum(nil))
		if hmac.Equal([]byte(expected), []byte(sig)) {
			return true
		}
	}
	return false
}

{
  "eventId": "8f14e45f-ceea-3f2a-9a3f-1b2c0d4e5f60",
  "eventType": "account.opened",
  "eventCategory": "account",
  "eventCreatedAt": "2026-09-30T06:21:44.500Z",
  "version": "2026-09.1",
  "data": {
    "id": "acct_7Kq2XbN4mR8vLp1DcYtZ",
    "customerId": "cus_9FpQ2LmZ8sW4TxKn1BvD",
    "category": "ONRAMP",
    "currency": "gbp",
    "status": "activated"
  }
}

{
  "eventId": "3b91d7f0-a25c-38e1-b7d4-9c0e15a6f2bb",
  "eventType": "account.updated",
  "eventCategory": "account",
  "eventCreatedAt": "2026-09-30T07:02:11.184Z",
  "version": "2026-09.1",
  "data": {
    "id": "acct_7Kq2XbN4mR8vLp1DcYtZ",
    "customerId": "cus_9FpQ2LmZ8sW4TxKn1BvD",
    "category": "ONRAMP",
    "currency": "gbp",
    "status": "activated"
  }
}