Webhooks

function verifyLetfoldWebhook(string $secret, array $headers, string $rawBody): bool
{
    $id = $headers['webhook-id'] ?? ''; $ts = $headers['webhook-timestamp'] ?? ''; $sig = $headers['webhook-signature'] ?? '';
    if (! ctype_digit($ts) || abs(time() - (int) $ts) > 300) return false;
    $key = base64_decode(substr($secret, strlen('whsec_')));
    $expected = 'v1,' . base64_encode(hash_hmac('sha256', "$id.$ts.$rawBody", $key, true));
    foreach (explode(' ', $sig) as $candidate) {
        if (hash_equals($expected, $candidate)) return true;
    }
    return false;
}

// Express/Laravel-style: read the RAW body, not a parsed array.
if (! verifyLetfoldWebhook(getenv('LETFOLD_WEBHOOK_SECRET'), getallheaders(), file_get_contents('php://input'))) {
    http_response_code(401); exit;
}
$event = json_decode(file_get_contents('php://input'), true);
http_response_code(200);   // answer fast; do the work after

import crypto from 'node:crypto';

export function verifyLetfoldWebhook(secret, headers, rawBody) {
  const id = headers['webhook-id'], ts = headers['webhook-timestamp'], sig = headers['webhook-signature'] || '';
  if (!/^\d+$/.test(ts) || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = 'v1,' + crypto.createHmac('sha256', key).update(`${id}.${ts}.${rawBody}`).digest('base64');
  return sig.split(' ').some(c => c.length === expected.length && crypto.timingSafeEqual(Buffer.from(c), Buffer.from(expected)));
}

// express: app.post('/webhooks/letfold', express.raw({ type: '*/*' }), (req, res) => { ... req.body is a Buffer ... })

import base64, hmac, hashlib, time

def verify_letfold_webhook(secret: str, headers: dict, raw_body: bytes) -> bool:
    wid, ts, sig = headers.get("webhook-id", ""), headers.get("webhook-timestamp", ""), headers.get("webhook-signature", "")
    if not ts.isdigit() or abs(time.time() - int(ts)) > 300:
        return False
    key = base64.b64decode(secret.removeprefix("whsec_"))
    expected = "v1," + base64.b64encode(hmac.new(key, f"{wid}.{ts}.".encode() + raw_body, hashlib.sha256).digest()).decode()
    return any(hmac.compare_digest(expected, c) for c in sig.split(" "))