Webhook Documentation

from cryptography.hazmat.primitives.asymmetric import ed25519
from cryptography.hazmat.primitives import serialization
from cryptography.exceptions import InvalidSignature
import base64
import json

def verify_webhook_signature(payload_dict, signature_b64, public_key_pem):
    # Convert payload to compact, sorted JSON string to match backend exactly
    payload_str = json.dumps(payload_dict, separators=(',', ':'), sort_keys=True)
    
    # Decode base64 signature
    signature_bytes = base64.b64decode(signature_b64)
    
    # Load Ed25519 public key
    public_key = serialization.load_pem_public_key(public_key_pem.encode('utf-8\))
    
    try:
        public_key.verify(signature_bytes, payload_str.encode('utf-8\))
        return True
    except InvalidSignature:
        return False

# Usage
if verify_webhook_signature(request.json(), request.headers.get('X-Webhook-Signature\), "YOUR_PUBLIC_KEY"):
    print("Signature verified!")

const crypto = require('crypto');

function verifyWebhookSignature(payloadDict, signatureB64, publicKeyPem) {
    // Stringify with sorted keys and no spaces
    const payloadStr = JSON.stringify(payloadDict, Object.keys(payloadDict).sort());
    
    const signatureBytes = Buffer.from(signatureB64, 'base64');
    
    return crypto.verify(
        null, 
        Buffer.from(payloadStr), 
        publicKeyPem, 
        signatureBytes
    );
}

// Usage
if (verifyWebhookSignature(req.body, req.headers['x-webhook-signature'], "YOUR_PUBLIC_KEY")) {
    console.log("Signature verified!");
}

<?php
function verifyWebhookSignature($payload_array, $signature_b64, $public_key_pem) {
    // Sort keys recursively if needed, but for flat payload ksort is enough
    ksort($payload_array);
    $payload_str = json_encode($payload_array, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    
    $signature_bytes = base64_decode($signature_b64);
    $public_key_res = openssl_pkey_get_public($public_key_pem);
    $public_key_bytes = openssl_pkey_get_details($public_key_res)['key'];
    
    return sodium_crypto_sign_verify_detached($signature_bytes, $payload_str, $public_key_bytes);
}

// Usage
if (verifyWebhookSignature($_POST, $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'], "YOUR_PUBLIC_KEY")) {
    echo "Signature verified!";
}