Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const hash = crypto
    .createHmac('sha512', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
  
  return hash === signature;
}

// Usage in your webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-taxstreem-signature'];
  const isValid = verifyWebhookSignature(req.body, signature, process.env.TAXSTREEM_SECRET);
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process the event
  res.status(200).send('OK');
});

import hmac
import hashlib
import json

def verify_webhook_signature(payload, signature, secret):
    hash_obj = hmac.new(
        secret.encode('utf-8'),
        json.dumps(payload).encode('utf-8'),
        hashlib.sha512
    )
    return hash_obj.hexdigest() == signature

# Usage in Flask
@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('x-taxstreem-signature')
    is_valid = verify_webhook_signature(
        request.json, 
        signature, 
        os.environ['TAXSTREEM_SECRET']
    )
    
    if not is_valid:
        return 'Invalid signature', 401
    
    # Process the event
    return 'OK', 200

package main

import (
	"crypto/hmac"
	"crypto/sha512"
	"encoding/hex"
	"encoding/json"
)

func verifyWebhookSignature(payload interface{}, signature, secret string) bool {
	payloadBytes, _ := json.Marshal(payload)
	h := hmac.New(sha512.New, []byte(secret))
	h.Write(payloadBytes)
	computedHash := hex.EncodeToString(h.Sum(nil))
	return computedHash == signature
}

// Usage in HTTP handler
func webhookHandler(w http.ResponseWriter, r *http.Request) {
	signature := r.Header.Get("x-taxstreem-signature")
	var payload map[string]interface{}
	json.NewDecoder(r.Body).Decode(&payload)
	
	if !verifyWebhookSignature(payload, signature, os.Getenv("TAXSTREEM_SECRET")) {
		http.Error(w, "Invalid signature", http.StatusUnauthorized)
		return
	}
	
	// Process the event
	w.WriteHeader(http.StatusOK)
}