Verify webhook events

const crypto = require("crypto");
const secret = process.env.PILA_SECRET_KEY;

// Using Express
app.post("/webhookurl", (req, res) => {
  const hash = crypto
    .createHmac("sha256", secret)
    .update(JSON.stringify(req.body))
    .digest("hex");

  const signature = req.headers["x-pila-signature"];

  if (
    !signature ||
    !crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(signature))
  ) {
    return res.sendStatus(401);
  }

  const event = req.body;
  // Do something with event

  res.sendStatus(200);
});

import hmac
import hashlib
import os

from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["PILA_SECRET_KEY"].encode()


@app.post("/webhookurl")
def pila_webhook() -> tuple[str, int]:
    signature = request.headers.get("x-pila-signature", "")
    expected = hmac.new(SECRET, request.get_data(), hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, signature):
        abort(401)

    event = request.get_json()
    # Do something with event

    return "", 200

<?php
$secret = getenv('PILA_SECRET_KEY');
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_PILA_SIGNATURE'] ?? '';

$expected = hash_hmac('sha256', $payload, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit();
}

$event = json_decode($payload, true);
// Do something with event

http_response_code(200);