Webhooks

import crypto from 'node:crypto';
import express from 'express';
 
const app = express();
 
// Critical: use raw body parser, NOT json. We need the exact bytes.
app.post(
  '/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-gosendapi-signature'];
    const expected = 'sha256=' + crypto
      .createHmac('sha256', process.env.WEBHOOK_SECRET)
      .update(req.body)
      .digest('hex');
 
    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
      return res.status(401).send('Invalid signature');
    }
 
    const event = JSON.parse(req.body.toString('utf8'));
    console.log('Received', event.event);
 
    // Acknowledge fast — process async
    res.status(200).send('OK');
 
    // Then process in background
    processEvent(event).catch(console.error);
  }
);

<?php
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_GOSENDAPI_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $rawBody, getenv('WEBHOOK_SECRET'));
 
if (!hash_equals($expected, $signature)) {
  http_response_code(401);
  exit('Invalid signature');
}
 
$event = json_decode($rawBody, true);
error_log('Received: ' . $event['event']);
 
// Acknowledge fast
http_response_code(200);
echo 'OK';
// fastcgi_finish_request() if available, then process

import hmac
import hashlib
import os
from flask import Flask, request, abort
 
app = Flask(__name__)
 
@app.route('/webhook', methods=['POST'])
def webhook():
    raw_body = request.get_data()  # raw bytes — important
    signature = request.headers.get('X-GoSendAPI-Signature', '')
    expected = 'sha256=' + hmac.new(
        os.environ['WEBHOOK_SECRET'].encode(),
        raw_body,
        hashlib.sha256
    ).hexdigest()
 
    if not hmac.compare_digest(signature, expected):
        abort(401, 'Invalid signature')
 
    event = request.get_json()
    print('Received:', event['event'])
 
    # Acknowledge fast, process async via Celery/RQ/etc.
    return 'OK', 200

package main
 
import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
	"os"
)
 
func webhook(w http.ResponseWriter, r *http.Request) {
	body, _ := io.ReadAll(r.Body)
 
	mac := hmac.New(sha256.New, []byte(os.Getenv("WEBHOOK_SECRET")))
	mac.Write(body)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
 
	if !hmac.Equal([]byte(expected), []byte(r.Header.Get("X-GoSendAPI-Signature"))) {
		http.Error(w, "invalid signature", 401)
		return
	}
 
	w.WriteHeader(200)
	w.Write([]byte("OK"))
}