Verify Edplay Webhook Signatures

const crypto = require('crypto');
const express = require('express');

const app = express();
const SECRET = process.env.EDPLAY_WEBHOOK_SECRET;

// express.raw keeps the body as bytes — express.json() would destroy it
app.post('/webhooks/edplay', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto.createHmac('sha256', SECRET).update(req.body).digest('hex');
  const received = req.get('Signature') || '';

  const expectedBuffer = Buffer.from(expected, 'utf8');
  const receivedBuffer = Buffer.from(received, 'utf8');

  if (
    expectedBuffer.length !== receivedBuffer.length ||
    !crypto.timingSafeEqual(expectedBuffer, receivedBuffer)
  ) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(req.body.toString('utf8'));
  enqueue(payload);        // your own queue
  res.sendStatus(200);     // answer immediately
});

use Illuminate\Http\Request;

public function handle(Request $request)
{
    $expected = hash_hmac(
        'sha256',
        $request->getContent(),
        config('services.edplay.webhook_secret')
    );

    if (! hash_equals($expected, (string) $request->header('Signature'))) {
        abort(401, 'Invalid signature');
    }

    ProcessEdplayWebhook::dispatch($request->json()->all());

    return response()->noContent();
}

import hashlib
import hmac
import os

from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["EDPLAY_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/edplay")
def edplay_webhook():
    expected = hmac.new(SECRET, request.get_data(), hashlib.sha256).hexdigest()
    received = request.headers.get("Signature", "")

    if not hmac.compare_digest(expected, received):
        abort(401)

    enqueue(request.get_json())   # your own queue
    return "", 200