Webhooks

import hashlib
import hmac

def verify_kurnl_webhook(body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header)

# In your handler:
sig = request.headers.get("X-Webhook-Signature", "")
if not verify_kurnl_webhook(request.body, sig, KURNL_WEBHOOK_SECRET):
    return Response(status_code=401)

const crypto = require('crypto');

function verifyKurnlWebhook(body, header, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(header)
  );
}

// In your handler:
const sig = req.headers['x-webhook-signature'] || '';
if (!verifyKurnlWebhook(req.rawBody, sig, process.env.KURNL_WEBHOOK_SECRET)) {
  return res.status(401).send('Invalid signature');
}

function verifyKurnlWebhook(string $body, string $header, string $secret): bool {
    $expected = 'sha256=' . hash_hmac('sha256', $body, $secret);
    return hash_equals($expected, $header);
}

// In your handler:
$sig = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
if (!verifyKurnlWebhook(file_get_contents('php://input'), $sig, getenv('KURNL_WEBHOOK_SECRET'))) {
    http_response_code(401);
    exit;
}