Webhooks

const crypto = require('crypto');

// `rawBody` debe ser el cuerpo sin parsear: si lo reserializas, la firma no coincide.
function verifyWebhook(req, rawBody, { token, secret }) {
  const sentToken = req.headers['x-webhook-token'] ?? '';
  const tokenOk = crypto.timingSafeEqual(Buffer.from(sentToken), Buffer.from(token));
  if (!tokenOk) return false;

  if (!secret) return true; // webhook sin secret: solo hay token

  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const sent = req.headers['signature'] ?? '';
  return sent.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(sent), Buffer.from(expected));
}

import hmac, hashlib

def verify_webhook(headers, raw_body: bytes, token: str, secret: str | None) -> bool:
    if not hmac.compare_digest(headers.get('x-webhook-token', ''), token):
        return False

    if not secret:
        return True  # webhook sin secret: solo hay token

    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(headers.get('Signature', ''), expected)

<?php
function verifyWebhook(array $headers, string $rawBody, string $token, ?string $secret): bool
{
    if (! hash_equals($headers['x-webhook-token'] ?? '', $token)) {
        return false;
    }

    if ($secret === null) {
        return true; // webhook sin secret: solo hay token
    }

    $expected = hash_hmac('sha256', $rawBody, $secret);

    return hash_equals($headers['Signature'] ?? '', $expected);
}

# Así se ve una entrega entrante (el token es de muestra: su valor lo defines tú):
POST /tu-endpoint HTTP/1.1
x-webhook-token: whtok_6sG1OUZjWcif0XOYMu1HMf0SajtK
x-webhook-event: charge.paid
Signature: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
Content-Type: application/json