Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();

function verifyVestrapaySignature(rawBody, signatureHeader, secretKey) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", secretKey).update(rawBody).digest("hex");
  const a = Buffer.from(signatureHeader ?? "", "utf8");
  const b = Buffer.from(expected, "utf8");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Keep the body as a Buffer. Do not use express.json() on this route.
app.post(
  "/webhooks/vestrapay",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const ok = verifyVestrapaySignature(
      req.body, // Buffer
      req.get("X-Vestrapay-Signature"),
      process.env.VESTRAPAY_SECRET_KEY,
    );
    if (!ok) return res.status(401).end();

    const event = JSON.parse(req.body.toString("utf8"));
    res.status(200).end(); // acknowledge quickly

    // Enqueue: verify event.data.reference, then fulfil once
    queue.add("vestrapay-event", event);
  },
);

import hashlib
import hmac
import os

from flask import Flask, request

app = Flask(__name__)


def verify_signature(raw: bytes, header: str | None, secret_key: str) -> bool:
    expected = "sha256=" + hmac.new(secret_key.encode(), raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(header or "", expected)


@app.post("/webhooks/vestrapay")
def webhook():
    raw = request.get_data()  # raw bytes, before any JSON parsing
    header = request.headers.get("X-Vestrapay-Signature")
    if not verify_signature(raw, header, os.environ["VESTRAPAY_SECRET_KEY"]):
        return ("", 401)

    event = request.get_json(force=True)
    # Enqueue: verify event["data"]["reference"], then fulfil once
    return ("", 200)

<?php
$raw = file_get_contents("php://input");
$header = $_SERVER["HTTP_X_VESTRAPAY_SIGNATURE"] ?? "";
$expected = "sha256=" . hash_hmac("sha256", $raw, getenv("VESTRAPAY_SECRET_KEY"));

if (!hash_equals($expected, $header)) {
  http_response_code(401);
  exit;
}

$event = json_decode($raw, true);
http_response_code(200);
// Enqueue: verify $event["data"]["reference"], then fulfil once