Webhooks Overview

const express = require('express');
const crypto = require('crypto');

const app = express();
app.use(express.json());

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

function webhookSubjectId(event) {
  return event.data.id || event.data.deposit_id;
}

function dedupeKey(event) {
  return event.id || `${event.event}:${webhookSubjectId(event)}:${event.timestamp}`;
}

app.post('/webhooks/daya', (req, res) => {
  const signature = req.headers['x-daya-signature'];
  const payload = JSON.stringify(req.body);

  if (!verifySignature(payload, signature, process.env.DAYA_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const key = dedupeKey(req.body);
  if (isProcessed(key)) {
    return res.status(200).send('Already processed');
  }

  queue.add('process-webhook', req.body);
  markAsProcessed(key);

  res.status(200).send('OK');
});

from flask import Flask, request, jsonify
import hashlib
import hmac

app = Flask(__name__)

def verify_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

def webhook_subject_id(event):
    return event["data"].get("id") or event["data"].get("deposit_id")

def dedupe_key(event):
    return event.get("id") or f'{event["event"]}:{webhook_subject_id(event)}:{event["timestamp"]}'

@app.route('/webhooks/daya', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Daya-Signature')
    payload = request.get_data()

    if not verify_signature(payload, signature, DAYA_WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    event = request.json
    key = dedupe_key(event)

    if is_processed(key):
        return jsonify({'status': 'already_processed'}), 200

    queue.enqueue('process_webhook', event)
    mark_as_processed(key)

    return jsonify({'status': 'ok'}), 200