Configuração

const crypto = require('crypto');

function validateSignature(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');

  const received = signature.replace('sha256=', '');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(received)
  );
}

// Uso no Express
app.post('/webhooks', (req, res) => {
  const signature = req.headers['x-worldfy-signature'];
  const isValid = validateSignature(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  // Processar evento...
  res.status(200).send('OK');
});

import hmac
import hashlib

def validate_signature(body: str, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        body.encode(),
        hashlib.sha256
    ).hexdigest()

    received = signature.replace('sha256=', '')
    return hmac.compare_digest(expected, received)

function validateSignature(string $body, string $signature, string $secret): bool
{
    $expected = hash_hmac('sha256', $body, $secret);
    $received = str_replace('sha256=', '', $signature);
    return hash_equals($expected, $received);
}