Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";
 
function verifyWebhook(rawBody, sigHeader, secret) {
  const parts = Object.fromEntries(
    sigHeader.split(",").map((p) => p.split("=", 2))
  );
  const ts = parts["t"];
  const v1 = parts["v1"];
  if (!ts || !v1) throw new Error("missing t or v1");
 
  // Reject stale timestamps (5-minute tolerance)
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    throw new Error("timestamp too old");
  }
 
  const expected = createHmac("sha256", secret)
    .update(rawBody)
    .update(".")
    .update(ts)
    .digest("hex");
 
  if (!timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) {
    throw new Error("signature mismatch");
  }
}

import hashlib
import hmac
import time
 
def verify_webhook(raw_body: bytes, sig_header: str, secret: str) -> None:
    parts = dict(p.split("=", 1) for p in sig_header.split(","))
    ts = parts.get("t")
    v1 = parts.get("v1")
    if not ts or not v1:
        raise ValueError("missing t or v1")
 
    if abs(time.time() - float(ts)) > 300:
        raise ValueError("timestamp too old")
 
    message = raw_body + b"." + ts.encode()
    expected = hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()
 
    if not hmac.compare_digest(v1, expected):
        raise ValueError("signature mismatch")

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "errors"
    "math"
    "strconv"
    "strings"
    "time"
)
 
func verifyWebhook(rawBody []byte, sigHeader, secret string) error {
    parts := map[string]string{}
    for _, p := range strings.Split(sigHeader, ",") {
        kv := strings.SplitN(p, "=", 2)
        if len(kv) == 2 {
            parts[strings.TrimSpace(kv[0])] = strings.TrimSpace(kv[1])
        }
    }
    ts, v1 := parts["t"], parts["v1"]
    if ts == "" || v1 == "" {
        return errors.New("missing t or v1")
    }
    tsInt, err := strconv.ParseInt(ts, 10, 64)
    if err != nil || math.Abs(float64(time.Now().Unix()-tsInt)) > 300 {
        return errors.New("timestamp too old or invalid")
    }
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(rawBody)
    mac.Write([]byte("."))
    mac.Write([]byte(ts))
    expected := hex.EncodeToString(mac.Sum(nil))
    if !hmac.Equal([]byte(v1), []byte(expected)) {
        return errors.New("signature mismatch")
    }
    return nil
}

function verifyWebhook(string $rawBody, string $sigHeader, string $secret): void {
    $parts = [];
    foreach (explode(',', $sigHeader) as $p) {
        [$k, $v] = explode('=', $p, 2);
        $parts[trim($k)] = trim($v);
    }
    $ts = $parts['t'] ?? '';
    $v1 = $parts['v1'] ?? '';
    if (!$ts || !$v1) {
        throw new \InvalidArgumentException('missing t or v1');
    }
    if (abs(time() - (int)$ts) > 300) {
        throw new \InvalidArgumentException('timestamp too old');
    }
    $expected = hash_hmac('sha256', $rawBody . '.' . $ts, $secret);
    if (!hash_equals($v1, $expected)) {
        throw new \InvalidArgumentException('signature mismatch');
    }
}

curl "https://api.sautikit.com/v1/webhooks/{subscription_id}/deliveries" \
  -H "Authorization: Bearer $SAUTIKIT_API_KEY"