Signature Verification

import hmac, hashlib

def verify(secret: str, headers: dict, raw_body: bytes) -> bool:
    ts = headers.get("X-Linkup-Timestamp", "")
    sig = headers.get("X-Linkup-Signature", "")
    if not sig.startswith("v1="):
        return False
    expected = hmac.new(
        secret.encode(),
        f"{ts}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, sig[3:])

const crypto = require("crypto");

function verify(secret, headers, rawBody) {
  const ts = headers["x-linkup-timestamp"] || "";
  const sig = headers["x-linkup-signature"] || "";
  if (!sig.startsWith("v1=")) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.`)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.slice(3)));
}