import { Webhook, WebhookVerificationError } from "standardwebhooks";

// rawBody must be the raw request body string, not a parsed object.
const wh = new Webhook(process.env.WEBHOOK_SECRET); // "whsec_…"

try {
  const event = wh.verify(rawBody, {
    "webhook-id": req.headers["webhook-id"],
    "webhook-timestamp": req.headers["webhook-timestamp"],
    "webhook-signature": req.headers["webhook-signature"],
  });
  // event is the verified, parsed payload.
} catch (err) {
  if (err instanceof WebhookVerificationError) {
    // Verification failed. Respond 400 and do not process the payload.
  }
}

from standardwebhooks import Webhook, WebhookVerificationError

# raw_body must be the raw request body bytes or string, not a parsed dict.
wh = Webhook(os.environ["WEBHOOK_SECRET"])  # "whsec_…"

try:
    event = wh.verify(raw_body, {
        "webhook-id": headers["webhook-id"],
        "webhook-timestamp": headers["webhook-timestamp"],
        "webhook-signature": headers["webhook-signature"],
    })
    # event is the verified, parsed payload.
except WebhookVerificationError:
    # Verification failed. Respond 400 and do not process the payload.
    pass

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(
  secret: string,
  headers: Record<string, string>,
  rawBody: string,
): boolean {
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const msgId = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatureHeader = headers["webhook-signature"];

  const signedContent = `${msgId}.${timestamp}.${rawBody}`;
  const expected = createHmac("sha256", key).update(signedContent).digest();

  // webhook-signature may hold several space-delimited "v1,<base64>" values.
  return signatureHeader.split(" ").some((part) => {
    const [version, sig] = part.split(",");
    if (version !== "v1" || !sig) return false;
    const sigBuf = Buffer.from(sig, "base64");
    return sigBuf.length === expected.length && timingSafeEqual(sigBuf, expected);
  });
}

import base64
import hashlib
import hmac

def verify(secret, headers, raw_body):
    key = base64.b64decode(secret.removeprefix("whsec_") + "==")
    msg_id = headers["webhook-id"]
    timestamp = headers["webhook-timestamp"]
    signature_header = headers["webhook-signature"]

    signed_content = f"{msg_id}.{timestamp}.{raw_body}".encode()
    expected = base64.b64encode(hmac.new(key, signed_content, hashlib.sha256).digest()).decode()

    # webhook-signature may hold several space-delimited "v1,<base64>" values.
    for part in signature_header.split(" "):
        version, _, sig = part.partition(",")
        if version == "v1" and hmac.compare_digest(sig, expected):
            return True
    return False