Webhooks

With the SDK

import { verifyWebhook } from "@ducto/sdk";

// The raw body, exactly as received (not re-serialized JSON).
const ok = await verifyWebhook(process.env.DUCTO_WEBHOOK_SECRET!, rawBody, req.headers.get("ducto-signature"));
if (!ok) return new Response(null, { status: 400 });
const event = JSON.parse(rawBody); // { id, type, created, data }
// Deliveries can repeat: skip an event.id you've already handled.

Node, no SDK

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(secret, rawBody, header, toleranceSec = 300) {
  const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header ?? "");
  if (!m || Math.abs(Date.now() / 1000 - Number(m[1])) > toleranceSec) return false;
  const mac = createHmac("sha256", secret).update(`${m[1]}.${rawBody}`).digest();
  return timingSafeEqual(mac, Buffer.from(m[2], "hex"));
}

Python

import hashlib, hmac, re, time

def verify(secret: str, raw_body: bytes, header: str, tolerance: int = 300) -> bool:
    m = re.fullmatch(r"t=(\d+),v1=([0-9a-f]{64})", header or "")
    if not m or abs(time.time() - int(m.group(1))) > tolerance:
        return False
    mac = hmac.new(secret.encode(), m.group(1).encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, m.group(2))