Webhooks

import hashlib
import hmac

def verify(raw_body: bytes, signature_header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

# Flask example
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_a1b2c3d4e5f6a7b8c9d0e1f2"  # the secret you registered

@app.post("/coverbase")
def receive():
    raw = request.get_data()  # raw bytes, do not re-serialize
    sig = request.headers.get("Coverbase-Signature", "")
    if not verify(raw, sig, WEBHOOK_SECRET):
        abort(401)
    event = request.get_json()
    # dedupe on request.headers["X-Coverbase-Event-Id"] before handling
    return "", 200

const crypto = require("crypto");

function verify(rawBody, signatureHeader, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express example (use express.raw so rawBody is the unparsed buffer)
app.post(
  "/coverbase",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.header("Coverbase-Signature") || "";
    if (!verify(req.body, sig, process.env.WEBHOOK_SECRET)) {
      return res.status(401).end();
    }
    const event = JSON.parse(req.body.toString("utf8"));
    // dedupe on req.header("X-Coverbase-Event-Id") before handling
    res.status(200).end();
  },
);