Webhooks

{
  "id": "0b8b2b3e-…",
  "event": "key.disabled",
  "app_id": "6f2393b5-…",
  "created_at": "2026-08-31T18:12:04Z",
  "data": { "key_id": "oauth:…", "curve": "ecdsa_secp256k1" }
}

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(secret: string, headers: Headers, rawBody: string) {
  const timestamp = headers.get("signet-timestamp") ?? "";
  const signature = headers.get("signet-signature") ?? "";

  // The timestamp is signed, but a genuine old delivery can still be
  // resent — so reject anything stale outright.
  if (!timestamp || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const mac = createHmac("sha256", secret);
  mac.update(timestamp);
  mac.update(".");
  mac.update(rawBody);            // the raw bytes, before any JSON parsing
  const expected = `v1=${mac.digest("hex")}`;

  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}