Signing & verification

import hmac, hashlib
from fastapi import FastAPI, Request, HTTPException

WEBHOOK_SECRET = b"whsec_..."

app = FastAPI()

@app.post("/webhooks/ontora")
async def receive(request: Request):
    body = await request.body()
    sent = request.headers.get("X-Ontora-Signature", "")
    expected = "sha256=" + hmac.new(WEBHOOK_SECRET, body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sent, expected):
        raise HTTPException(status_code=401, detail="invalid signature")

    payload = await request.json()
    # ... handle payload
    return {"ok": True}

import crypto from "node:crypto";
import express from "express";

const WEBHOOK_SECRET = process.env.ONTORA_WEBHOOK_SECRET!;
const app = express();

// Capture the raw body — required for verification.
app.use("/webhooks/ontora", express.raw({ type: "application/json" }));

app.post("/webhooks/ontora", (req, res) => {
  const sent = req.header("X-Ontora-Signature") ?? "";
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", WEBHOOK_SECRET).update(req.body).digest("hex");

  if (
    sent.length !== expected.length ||
    !crypto.timingSafeEqual(Buffer.from(sent), Buffer.from(expected))
  ) {
    return res.status(401).send("invalid signature");
  }

  const payload = JSON.parse(req.body.toString());
  // ... handle payload
  res.json({ ok: true });
});

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
)

var webhookSecret = []byte("whsec_...")

func handler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    sent := r.Header.Get("X-Ontora-Signature")

    mac := hmac.New(sha256.New, webhookSecret)
    mac.Write(body)
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(sent), []byte(expected)) {
        http.Error(w, "invalid signature", http.StatusUnauthorized)
        return
    }

    // ... handle payload
    w.WriteHeader(http.StatusOK)
}