Webhooks overview

<?php
$secret_key = "secretkey";
// Use the raw request body; don't use $_POST or re-encoded JSON.
$payload = file_get_contents('php://input');
$received_signature = $_SERVER['HTTP_SENDCLOUD_SIGNATURE'] ?? '';

$expected_signature = hash_hmac('sha256', $payload, $secret_key);

if (!hash_equals($expected_signature, $received_signature)) {
    http_response_code(401);
    exit;
}

// Example: for the body {"key": "value"} and secret "secretkey",
// the signature is 1eed4b3d41f4653ac64fd56f1bf1cbfd349e4482cbc11dff7134bd93e5da4b0a

import hmac
import hashlib

def is_valid_signature(raw_body: bytes, received_signature: str, secret_key: str) -> bool:
    # Hash the raw request body exactly as received; don't parse and re-serialise it.
    expected = hmac.new(secret_key.encode("utf-8"), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received_signature)

# Example: for the body {"key": "value"} and secret "secretkey",
# the signature is 1eed4b3d41f4653ac64fd56f1bf1cbfd349e4482cbc11dff7134bd93e5da4b0a
assert is_valid_signature(
    b'{"key": "value"}',
    "1eed4b3d41f4653ac64fd56f1bf1cbfd349e4482cbc11dff7134bd93e5da4b0a",
    "secretkey",
)