How to verify webhook signatures with HMAC-SHA256

import hashlib, hmac, os, time

SECRET = os.environ["URLPIPE_WEBHOOK_SECRET"].encode()
TOLERANCE = 300  # seconds

def verify(raw_body: bytes, timestamp: str, header: str) -> bool:
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > TOLERANCE:
        return False
    signed = timestamp.encode() + b"." + raw_body
    expected = "v1=" + hmac.new(SECRET, signed, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(sig.strip(), expected) for sig in header.split(","))

const crypto = require("crypto");

const SECRET = process.env.URLPIPE_WEBHOOK_SECRET;
const TOLERANCE = 300; // seconds

// rawBody: a Buffer — e.g. from express.raw({ type: "application/json" })
function verify(rawBody, timestamp, header) {
  const ts = Number(timestamp);
  if (!Number.isInteger(ts) || Math.abs(Date.now() / 1000 - ts) > TOLERANCE) return false;
  const expected = Buffer.from("v1=" + crypto.createHmac("sha256", SECRET)
    .update(`${ts}.`).update(rawBody).digest("hex"));
  return header.split(",").some((sig) => {
    const given = Buffer.from(sig.trim());
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

require "openssl"

SECRET = ENV.fetch("URLPIPE_WEBHOOK_SECRET")
TOLERANCE = 300 # seconds

# raw_body: request.raw_post in Rails, request.body.read in Rack
def verify(raw_body, timestamp, header)
  return false unless timestamp.to_s.match?(/\A\d+\z/)
  return false if (Time.now.to_i - timestamp.to_i).abs > TOLERANCE

  expected = "v1=" + OpenSSL::HMAC.hexdigest("SHA256", SECRET, "#{timestamp}.#{raw_body}")
  header.to_s.split(",").any? { |sig| OpenSSL.secure_compare(sig.strip, expected) }
end

<?php
const TOLERANCE = 300; // seconds

function verify(string $rawBody, string $timestamp, string $header): bool {
    if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > TOLERANCE) {
        return false;
    }
    $secret = getenv("URLPIPE_WEBHOOK_SECRET");
    $expected = "v1=" . hash_hmac("sha256", "{$timestamp}.{$rawBody}", $secret);
    foreach (explode(",", $header) as $sig) {
        if (hash_equals($expected, trim($sig))) {
            return true;
        }
    }
    return false;
}

// $rawBody = file_get_contents("php://input");

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"math"
	"os"
	"strconv"
	"strings"
	"time"
)

const tolerance = 300 // seconds

func Verify(rawBody []byte, timestamp, header string) bool {
	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil || math.Abs(float64(time.Now().Unix()-ts)) > tolerance {
		return false
	}
	mac := hmac.New(sha256.New, []byte(os.Getenv("URLPIPE_WEBHOOK_SECRET")))
	mac.Write([]byte(timestamp + "."))
	mac.Write(rawBody)
	expected := []byte("v1=" + hex.EncodeToString(mac.Sum(nil)))
	for _, sig := range strings.Split(header, ",") {
		if hmac.Equal([]byte(strings.TrimSpace(sig)), expected) {
			return true
		}
	}
	return false
}