Webhooks Guide

import crypto from 'crypto';

function verifyWebhook(
  rawBody: string,     // raw request body string (before JSON.parse)
  secret: string,      // your webhook secret from AtlasBrokers settings
  header: string,      // value of X-Webhook-Secret header
): boolean {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(header, 'hex'),
  );
}

import hmac, hashlib

def verify_webhook(raw_body: bytes, secret: str, header: str) -> bool:
    expected = hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, header)