Webhooks

TypeScript / Node.js

import crypto from "node:crypto";

function verifySignature(secret: string, rawBody: string, signature: string): boolean {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

// Express example
app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const sig = req.headers["x-vem-signature"] as string;
  if (!verifySignature(process.env.WEBHOOK_SECRET!, req.body.toString(), sig)) {
    return res.status(401).send("Invalid signature");
  }
  const payload = JSON.parse(req.body.toString());
  console.log("Event:", payload.event);
  res.status(200).send("OK");
});

Python

import hmac, hashlib

def verify_signature(secret: str, raw_body: bytes, signature: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

@app.route("/webhook", methods=["POST"])
def webhook():
    sig = request.headers.get("X-Vem-Signature", "")
    if not verify_signature(os.environ["WEBHOOK_SECRET"], request.data, sig):
        return "Invalid signature", 401
    print(f"Event: {request.json['event']}")
    return "OK", 200