Webhooks

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.SUPERPAY_WEBHOOK_SECRET;

// express.raw — NOT express.json. The signature covers the exact bytes.
app.post('/webhooks/superpay', express.raw({ type: 'application/json' }), (req, res) => {
  const id = req.header('Webhook-Id');
  const timestamp = req.header('Webhook-Timestamp');

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return res.sendStatus(400);

  const expected = Buffer.from(
    crypto
      .createHmac('sha256', SECRET)
      .update(`${id}.${timestamp}.${req.body}`)
      .digest('base64')
  );

  const valid = (req.header('Webhook-Signature') || '')
    .split(' ')
    .map(s => Buffer.from(s.replace(/^v1,/, '')))
    .some(sig => sig.length === expected.length && crypto.timingSafeEqual(sig, expected));

  if (!valid) return res.sendStatus(400);

  res.sendStatus(200);                 // ack first
  enqueue(id, JSON.parse(req.body));   // dedupe on id, process async
});

import base64, hashlib, hmac, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["SUPERPAY_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/superpay")
def superpay_webhook():
    wid = request.headers["Webhook-Id"]
    ts = request.headers["Webhook-Timestamp"]
    if abs(time.time() - int(ts)) > 300:
        abort(400)

    signed = f"{wid}.{ts}.".encode() + request.get_data()  # raw bytes
    expected = base64.b64encode(hmac.new(SECRET, signed, hashlib.sha256).digest()).decode()

    sigs = [s.removeprefix("v1,") for s in request.headers.get("Webhook-Signature", "").split()]
    if not any(hmac.compare_digest(s, expected) for s in sigs):
        abort(400)

    enqueue(wid, request.get_json())  # dedupe on wid, process async
    return "", 200