Verify Signature

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;

public boolean verifyWebhook(String apiKey, String timestamp, String hmacHeader, 
                              String body, String secret) {
    String signingData = apiKey + ":" + timestamp + ":" + body;
    
    Mac mac = Mac.getInstance("HmacSHA256");
    SecretKeySpec keySpec = new SecretKeySpec(
        secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
    mac.init(keySpec);
    
    byte[] hash = mac.doFinal(signingData.getBytes(StandardCharsets.UTF_8));
    String computed = bytesToHex(hash);
    
    return computed.equalsIgnoreCase(hmacHeader);
}

import hmac
import hashlib

def verify_webhook(api_key: str, timestamp: str, hmac_header: str, 
                   body: str, secret: str) -> bool:
    signing_data = f"{api_key}:{timestamp}:{body}"
    computed = hmac.new(
        secret.encode('utf-8'),
        signing_data.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(computed.lower(), hmac_header.lower())

const crypto = require('crypto');

function verifyWebhook(apiKey, timestamp, hmacHeader, body, secret) {
    const signingData = `${apiKey}:${timestamp}:${body}`;
    const computed = crypto
        .createHmac('sha256', secret)
        .update(signingData)
        .digest('hex');
    return crypto.timingSafeEqual(
        Buffer.from(computed, 'hex'),
        Buffer.from(hmacHeader, 'hex')
    );
} const crypto = require('crypto');

function verifyWebhook(apiKey, timestamp, hmacHeader, body, secret) {
    const signingData = `${apiKey}:${timestamp}:${body}`;
    const computed = crypto
        .createHmac('sha256', secret)
        .update(signingData)
        .digest('hex');
    return crypto.timingSafeEqual(
        Buffer.from(computed, 'hex'),
        Buffer.from(hmacHeader, 'hex')
    );
} 

long receivedTimestamp = Long.parseLong(timestampHeader);
long now = System.currentTimeMillis();
if (Math.abs(now - receivedTimestamp) > 300_000) { // 5 minutes
    // Reject — potential replay attack
} long receivedTimestamp = Long.parseLong(timestampHeader);
long now = System.currentTimeMillis();
if (Math.abs(now - receivedTimestamp) > 300_000) { // 5 minutes
    // Reject — potential replay attack
}