Webhooks

/**
* Validates a webhook signature
* @param {string} payload - The raw request body as a string
* @param {string} signature - The signature from X-Webhook-Signature header 
* @param {string} webhookToken - Your webhook token 
* @returns {boolean} - Whether the signature is valid 
*/
function validateWebhookSignature(payload, signature, webhookToken) {
  const crypto = require('crypto'); 
  // Create HMAC using the webhook token
  const hmac = = crypto.createHmac('sha256', webhookToken);
  
  //Update with the payload
  hmac.update(payload);
  
  // Get the computed signature as hex
  const computedSignature = hmac.digest('hex');
  
  //// Compare signatures (using constant-time comparison to prevent timing attacks)
  return crypto.timingSafeEqual( 
    Buffer.from(computedSignature, 'hex'),
    Buffer.from(signature, 'hex')
  );
}

/// <summary>
/// Validates a webhook signature
/// </summary>
/// <param name="payload">The raw request body as a string</param> 
/// <param name="signature">The signature from X-Webhook-Signature header</param> 
/// <param name="webhookToken">Your webhook token</param>
/// <returns>Whether the signature is valid</returns> 
public bool ValidateWebhookSignature(string payload, string signature, string webhookToken)
{
  using (var hmac = new       System.Security.Cryptography.HMACSHA256(System.Text.Encoding.UTF8.GetBytes(webhookToken)))
  {
    // Compute the hash
    byte[] hash = hmac.ComputeHash(System.Text.Encoding.UTF8.GetBytes(payload));
    
    // Convert to hex string
    string computedSignature = BitConverter.ToString(hash).Replace("-", "").ToLower();
    
    // Compare signatures
    return string.Equals(computedSignature, signature, StringComparison.OrdinalIgnoreCase);
    
  }
}