The ultimate Webhook infrastructure for your SaaS

const crypto = require('crypto');

// Express webhook handler: HMAC-SHA256 Signature Verification
app.post('/webhook-receiver', (req, res) => {
  const signatureHeader = req.headers['x-souris-signature']; // 'sha256=...'
  const secret = 'external-secret-key';
  
  const hash = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(req.body))
    .digest('hex');

  if (signatureHeader !== `sha256=${hash}`) {
    return res.status(401).send('Invalid Signature');
  }

  // Process webhook safely...
  res.status(200).send('Webhook Processed');
});

import hmac
import hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def verify_webhook():
    signature = request.headers.get('x-souris-signature')
    secret = b"external-secret-key"
    
    computed = hmac.new(secret, request.data, hashlib.sha256).hexdigest()
    
    if not hmac.compare_digest(signature, f"sha256={computed}"):
        return "Unauthorized", 401
        
    # Event verified and safe
    return jsonify({"status": "success"}), 200

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"net/http"
)

func WebhookHandler(w http.ResponseWriter, r *http.Request) {
	sig := r.Header.Get("x-souris-signature")
	secret := []byte("external-secret-key")
	
	mac := hmac.New(sha256.New, secret)
	// Write body to hash and calculate sum
	
	expectedMAC := hex.EncodeToString(mac.Sum(nil))
	if !hmac.Equal([]byte(sig), []byte("sha256="+expectedMAC)) {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	w.WriteHeader(http.StatusOK)
}