Set Up Webhooks

import { createHmac, timingSafeEqual } from "crypto";

// rawBody: the exact request body string, before any JSON parsing.
function verifySignature(rawBody: string, header: string, signingKey: string): boolean {
  const expected = createHmac("sha256", signingKey).update(rawBody).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(header, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

// Accept the request if either signature matches.
// Secondary-Signature is only present during key rotation.
function isRequestFromRain(
  rawBody: string,
  signatureHeader: string,
  signingKey: string,
  secondarySignatureHeader?: string,
): boolean {
  if (verifySignature(rawBody, signatureHeader, signingKey)) return true;
  return secondarySignatureHeader
    ? verifySignature(rawBody, secondarySignatureHeader, signingKey)
    : false;
}

// Call it with the values from the incoming request. Read the
// Signature and Secondary-Signature headers and pass the raw body.
const valid = isRequestFromRain(
  rawBody,
  signatureHeader,
  signingKey,
  secondarySignatureHeader,
);

import hmac
import hashlib

# raw_body: the exact request body bytes, before any JSON parsing.
def verify_signature(raw_body: bytes, header: str, signing_key: str) -> bool:
    expected = hmac.new(signing_key.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

# Accept the request if either signature matches.
# Secondary-Signature is only present during key rotation.
def is_request_from_rain(raw_body, signature_header, signing_key, secondary_signature_header=None):
    if verify_signature(raw_body, signature_header, signing_key):
        return True
    if secondary_signature_header:
        return verify_signature(raw_body, secondary_signature_header, signing_key)
    return False

# Call it with the values from the incoming request. Read the
# Signature and Secondary-Signature headers and pass the raw body.
valid = is_request_from_rain(
    raw_body, signature_header, signing_key, secondary_signature_header
)