Verify Webhook Signatures

import { NextResponse } from 'next/server';
import { webhooks } from '@blinkpayments/sdk';

export async function POST(req: Request) {
  const signatureHeader = req.headers.get('blink-signature');
  const timestampHeader = req.headers.get('blink-timestamp');
  const webhookSecret = process.env.BLINK_WEBHOOK_SECRET!;

  const rawBody = await req.text();

  try {
    // This securely verifies the signature and parses the JSON payload.
    // It will throw an error if the signature is invalid or the timestamp is too old.
    const event = webhooks.constructEvent(
      rawBody, 
      signatureHeader, 
      timestampHeader, 
      webhookSecret
    );
    
    console.log('✅ Verified Event:', event.event);
    return NextResponse.json({ received: true });
    
  } catch (error: any) {
    console.error('❌ Webhook verification failed:', error.message);
    return NextResponse.json({ error: 'Invalid signature' }, { status: 401 });
  }
}

from fastapi import FastAPI, Request, HTTPException
from blink_api_client.webhooks import construct_event, InvalidSignatureError, ToleranceError
import os

app = FastAPI()

@app.post("/webhook")
async def webhook(request: Request):
    signature_header = request.headers.get('blink-signature')
    timestamp_header = request.headers.get('blink-timestamp')
    webhook_secret = os.environ.get("BLINK_WEBHOOK_SECRET")
    
    raw_body = await request.body()
    
    try:
        # Securely verify and parse the webhook
        event = construct_event(
            payload=raw_body.decode('utf-8'),
            signature_header=signature_header,
            timestamp_header=timestamp_header,
            secret=webhook_secret
        )
        
        print(f"✅ Verified Event: {event.get('event')}")
        return {"received": True}
        
    except (InvalidSignatureError, ToleranceError) as e:
        print(f"❌ Webhook verification failed: {str(e)}")
        raise HTTPException(status_code=401, detail="Invalid signature")

const express = require('express');
const crypto = require('crypto');

const app = express();

// The raw body is required to compute the signature correctly.
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signatureHeader = req.headers['blink-signature'];
  const timestamp = req.headers['blink-timestamp'];
  const webhookSecret = 'whsec_your_signing_secret_here';

  if (!signatureHeader || !timestamp) {
    return res.status(400).send('Missing webhook headers');
  }

  // Extract the actual signature hash from the v1= prefix
  const signature = signatureHeader.replace('v1=', '');

  // 1. Prepare the payload string
  const payloadToSign = `${timestamp}.${req.body.toString('utf8')}`;

  // 2. Compute the HMAC SHA-256 signature
  const expectedSignature = crypto
    .createHmac('sha256', webhookSecret)
    .update(payloadToSign)
    .digest('hex');

  // 3. Compare the signatures securely
  if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
    console.log('✅ Webhook signature verified!');
    
    const event = JSON.parse(req.body.toString('utf8'));
    res.status(200).send('OK');
  } else {
    res.status(401).send('Invalid signature');
  }
});

app.listen(3000, () => console.log('Listening on port 3000'));