Webhook Verification

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  // Compute expected signature
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
  
  // Timing-safe comparison
  try {
    return crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature)
    );
  } catch (error) {
    return false;
  }
}

// Express.js middleware
app.post('/webhooks/daya', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-daya-signature'];
  const payload = req.body.toString('utf8');
  
  if (!verifyWebhookSignature(payload, signature, process.env.DAYA_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Process webhook...
  const event = JSON.parse(payload);
  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
    """Verify webhook HMAC signature"""
    expected_signature = hmac.new(
        secret.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()
    
    # Timing-safe comparison
    return hmac.compare_digest(signature, expected_signature)

# Flask example
from flask import Flask, request, jsonify

@app.route('/webhooks/daya', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Daya-Signature')
    payload = request.get_data()
    
    if not verify_webhook_signature(payload, signature, DAYA_WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401
    
    # Process webhook...
    event = request.json
    return jsonify({'status': 'ok'}), 200

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
)

func verifyWebhookSignature(payload []byte, signature string, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(payload)
    expectedSignature := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expectedSignature))
}

func handleWebhook(w http.ResponseWriter, r *http.Request) {
    signature := r.Header.Get("X-Daya-Signature")
    payload, _ := io.ReadAll(r.Body)
    
    if !verifyWebhookSignature(payload, signature, DAYA_WEBHOOK_SECRET) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }
    
    // Process webhook...
    w.WriteHeader(http.StatusOK)
}

<?php

function verifyWebhookSignature($payload, $signature, $secret) {
    $expectedSignature = hash_hmac('sha256', $payload, $secret);
    return hash_equals($signature, $expectedSignature);
}

// Handle webhook
$signature = $_SERVER['HTTP_X_DAYA_SIGNATURE'];
$payload = file_get_contents('php://input');

if (!verifyWebhookSignature($payload, $signature, $webhookSecret)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

// Process webhook...
$event = json_decode($payload, true);
http_response_code(200);
echo json_encode(['status' => 'ok']);

# Generate test signature
echo -n '{"event":"withdrawal.completed","timestamp":"2026-03-10T09:03:00Z","data":{"id":"550e8400-e29b-41d4-a716-446655440000"}}' | \
  openssl dgst -sha256 -hmac "your_webhook_secret" | \
  awk '{print $2}'

const crypto = require('crypto');

function generateTestSignature(payload, secret) {
  return crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
}

const payload = '{"event":"withdrawal.completed","timestamp":"2026-03-10T09:03:00Z","data":{"id":"550e8400-e29b-41d4-a716-446655440000"}}';
const signature = generateTestSignature(payload, 'your_webhook_secret');
console.log(signature);