Verifying signatures

// npm install standardwebhooks
import express from "express";
import { Webhook } from "standardwebhooks";

const wh = new Webhook(process.env.FASTCAC_WEBHOOK_SECRET);
const app = express();

app.post("/fastcac/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    event = wh.verify(req.body.toString("utf8"), req.headers);
  } catch {
    return res.status(400).send("bad signature");
  }
  // event.id, event.type, event.data
  res.sendStatus(204);
});

# pip install standardwebhooks
import os
from flask import Flask, request
from standardwebhooks.webhooks import Webhook

wh = Webhook(os.environ["FASTCAC_WEBHOOK_SECRET"])
app = Flask(__name__)

@app.post("/fastcac/webhooks")
def fastcac_webhook():
    try:
        event = wh.verify(request.get_data(), dict(request.headers))
    except Exception:
        return "bad signature", 400
    # event["id"], event["type"], event["data"]
    return "", 204

// go get github.com/standard-webhooks/standard-webhooks/libraries/go
package main

import (
	"io"
	"net/http"
	"os"

	standardwebhooks "github.com/standard-webhooks/standard-webhooks/libraries/go"
)

func main() {
	wh, err := standardwebhooks.NewWebhook(os.Getenv("FASTCAC_WEBHOOK_SECRET"))
	if err != nil {
		panic(err)
	}
	http.HandleFunc("/fastcac/webhooks", func(w http.ResponseWriter, r *http.Request) {
		body, _ := io.ReadAll(r.Body)
		if err := wh.Verify(body, r.Header); err != nil {
			http.Error(w, "bad signature", http.StatusBadRequest)
			return
		}
		// json.Unmarshal(body, &event)
		w.WriteHeader(http.StatusNoContent)
	})
	http.ListenAndServe(":8080", nil)
}

<?php
// composer require svix/svix  (Svix's library verifies Standard Webhooks signatures)
require 'vendor/autoload.php';

$payload = file_get_contents('php://input');
$headers = [
    'webhook-id' => $_SERVER['HTTP_WEBHOOK_ID'] ?? '',
    'webhook-timestamp' => $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '',
    'webhook-signature' => $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '',
];

try {
    $wh = new \Svix\Webhook(getenv('FASTCAC_WEBHOOK_SECRET'));
    $event = $wh->verify($payload, $headers);
} catch (\Exception $e) {
    http_response_code(400);
    exit('bad signature');
}
http_response_code(204);