Webhooks

import { createHmac, timingSafeEqual } from "crypto";

function verifyWebhook(payload, secret) {
  // Destructuring creates a new object (non-mutating)
  const { signature, ...rest } = payload;
  const body = JSON.stringify(rest);
  const expected = createHmac("sha256", secret)
    .update(body)
    .digest("hex");
  
  // timingSafeEqual throws if lengths mismatch
  if (expected.length !== signature.length) {
    return false;
  }

  return timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

import hmac, hashlib, json

def verify_webhook(payload: dict, secret: str) -> bool:
    # Copy to avoid mutating the original dictionary
    payload_copy = payload.copy()
    signature = payload_copy.pop("signature", "")
    
    body = json.dumps(payload_copy, separators=(",", ":"))
    expected = hmac.new(
        secret.encode(), body.encode(), hashlib.sha256
      ).hexdigest()
      
    return hmac.compare_digest(expected, signature)

function verifyWebhook(array $payload, string $secret): bool {
    // PHP arrays are passed by value, so unset is safe here
    $signature = $payload['signature'] ?? '';
    unset($payload['signature']);
    
    // JSON_UNESCAPED_SLASHES is required to match JS/Python encoding
    $body = json_encode($payload, JSON_UNESCAPED_SLASHES);
    $expected = hash_hmac('sha256', $body, $secret);
    
    return hash_equals($expected, $signature);
}