Webhook delivery & verification

Signature verification (Node.js)

import crypto from 'crypto';

export function verifySignature(rawBody, signatureHeader, secret) {
  const [timestampPart, signaturePart] = signatureHeader.split(',');
  const timestamp = timestampPart.replace('t=', '');
  const provided = signaturePart.replace('v1=', '');

  const payload = `${timestamp}.${rawBody}`;
  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex');

  return crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
}

Build the payload as `timestamp.rawBody`. Reject requests older than 5 minutes to mitigate replay.