Webhooks

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body, 'utf8')
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your webhook handler:
const rawBody = req.body; // raw string, not parsed JSON
const signature = req.headers['x-cove-signature'];
if (!verifyWebhook(rawBody, signature, process.env.WEBHOOK_SECRET)) {
  return res.status(401).send('Invalid signature');
}

import hmac
import hashlib

def verify_webhook(body: bytes, signature: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# In your webhook handler:
raw_body = request.get_data()
signature = request.headers.get('X-Cove-Signature')
if not verify_webhook(raw_body, signature, os.environ['WEBHOOK_SECRET']):
    return 'Invalid signature', 401