Webhooks.

function verifyWebhookSignature($payload, $signature, $secret)
{
    // Extract the signature hash from the header
    $expectedSignature = str_replace('sha256=', '', $signature);

    // Compute the HMAC signature
    $computedSignature = hash_hmac('sha256', $payload, $secret);

    // Use hash_equals to prevent timing attacks
    return hash_equals($computedSignature, $expectedSignature);
}

// Usage in your webhook endpoint
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_MYSIGN_SIGNATURE'];
$webhookSecret = env('MYSIGN_WEBHOOK_SECRET');

if (!verifyWebhookSignature($payload, $signature, $webhookSecret)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Signature verified - process webhook
$event = json_decode($payload, true);

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  // Extract the signature hash from the header
  const expectedSignature = signature.replace('sha256=', '');

  // Compute the HMAC signature
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(payload);
  const computedSignature = hmac.digest('hex');

  // Use timingSafeEqual to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(computedSignature),
    Buffer.from(expectedSignature)
  );
}

// Usage in your Express webhook endpoint
app.post('/webhooks/mysign', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-mysign-signature'];
  const payload = req.body.toString();

  if (!verifyWebhookSignature(payload, signature, process.env.MYSIGN_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Signature verified - process webhook
  const event = JSON.parse(payload);
  // Handle event...

  res.status(200).send('OK');
});