Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.SAPA_WEBHOOK_SECRET; // whsec_…

function verify(header = "", raw) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(Buffer.concat([Buffer.from(`${parts.t}.`), raw]))
    .digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && typeof parts.v1 === "string" && parts.v1.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
}

app.post("/hooks/sapa", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.get("X-Sapa-Signature"), req.body)) return res.sendStatus(400);
  const event = JSON.parse(req.body.toString("utf8"));
  queue.push(event); // deduplicate by event.event_id and process asynchronously
  res.sendStatus(200); // answer within 10 seconds
});

import hashlib, hmac, os, time
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["SAPA_WEBHOOK_SECRET"].encode()  # whsec_…

def verify(header: str, raw: bytes) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t", ""), parts.get("v1", "")
    expected = hmac.new(SECRET, t.encode() + b"." + raw, hashlib.sha256).hexdigest()
    return t.isdigit() and abs(time.time() - int(t)) < 300 and hmac.compare_digest(expected, v1)

@app.post("/hooks/sapa")
def hook():
    raw = request.get_data()  # raw bytes, before parsing
    if not verify(request.headers.get("X-Sapa-Signature", ""), raw):
        abort(400)
    event = request.get_json()
    enqueue(event)  # deduplicate by event["event_id"]
    return "", 200

<?php
$secret = getenv('SAPA_WEBHOOK_SECRET'); // whsec_…
$raw = file_get_contents('php://input');  // raw body, before json_decode
$parts = [];
foreach (explode(',', $_SERVER['HTTP_X_SAPA_SIGNATURE'] ?? '') as $p) {
    [$k, $v] = array_pad(explode('=', $p, 2), 2, '');
    $parts[$k] = $v;
}
$expected = hash_hmac('sha256', ($parts['t'] ?? '') . '.' . $raw, $secret);
$fresh = abs(time() - (int) ($parts['t'] ?? 0)) < 300;
if (!$fresh || !hash_equals($expected, $parts['v1'] ?? '')) {
    http_response_code(400);
    exit;
}
$event = json_decode($raw, true);
enqueue($event); // deduplicate by $event['event_id']
http_response_code(200);

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public final class SapaSignature {
    /** header = X-Sapa-Signature, rawBody = the request body exactly as received. */
    public static boolean verify(String secret, String header, String rawBody) throws Exception {
        String t = null, v1 = null;
        for (String part : header.split(",")) {
            if (part.startsWith("t=")) t = part.substring(2);
            if (part.startsWith("v1=")) v1 = part.substring(3);
        }
        if (t == null || v1 == null) return false;
        if (Math.abs(Instant.now().getEpochSecond() - Long.parseLong(t)) > 300) return false;
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        String expected = HexFormat.of().formatHex(mac.doFinal((t + "." + rawBody).getBytes(StandardCharsets.UTF_8)));
        return MessageDigest.isEqual(expected.getBytes(StandardCharsets.UTF_8), v1.getBytes(StandardCharsets.UTF_8));
    }
}