Signature Verification

import hmac
import hashlib

def verify_webhook(request, secret_key):
    """Verify the webhook signature. Returns True if valid."""
    signature_header = request.headers.get('X-Paywise-Signature', '')
    if not signature_header.startswith('sha256='):
        return False

    received_signature = signature_header[7:]  # Strip 'sha256=' prefix
    expected_signature = hmac.new(
        secret_key.encode('utf-8'),
        request.body,
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(received_signature, expected_signature)


# Usage in a Django view:
def webhook_handler(request):
    SECRET_KEY = "your-secret-key-here"

    if not verify_webhook(request, SECRET_KEY):
        return HttpResponse(status=401)

    payload = json.loads(request.body)
    event_type = payload['event']

    # Process the event...
    return HttpResponse(status=200)

const crypto = require('crypto');

function verifyWebhook(req, secretKey) {
  const signature = req.headers['x-paywise-signature'] || '';
  if (!signature.startsWith('sha256=')) return false;

  const received = signature.slice(7);
  const expected = crypto
    .createHmac('sha256', secretKey)
    .update(req.body)  // raw body as Buffer
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(received),
    Buffer.from(expected)
  );
}

// Usage in an Express app:
app.post('/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  const SECRET_KEY = 'your-secret-key-here';

  if (!verifyWebhook(req, SECRET_KEY)) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(req.body);
  const eventType = payload.event;

  // Process the event...
  res.status(200).send('OK');
});

function verifyWebhook(string $payload, string $signatureHeader, string $secretKey): bool
{
    if (strpos($signatureHeader, 'sha256=') !== 0) {
        return false;
    }

    $received = substr($signatureHeader, 7);
    $expected = hash_hmac('sha256', $payload, $secretKey);

    return hash_equals($expected, $received);
}

// Usage:
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_PAYWISE_SIGNATURE'] ?? '';
$secretKey = 'your-secret-key-here';

if (!verifyWebhook($payload, $signature, $secretKey)) {
    http_response_code(401);
    exit('Invalid signature');
}

$data = json_decode($payload, true);
// Process the event...
http_response_code(200);