Webhooks

$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$secret    = getenv('VERILOCK_WEBHOOK_SECRET');

$expected = hash_hmac('sha256', $payload, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

match ($event['event']) {
    'session.completed'    => handleSession($event['data']),
    'aml.match_found'      => handleAmlMatch($event['data']),
    'transaction.blocked'  => handleBlocked($event['data']),
    'ambient.alert'        => handleAmbientAlert($event['data']),
    default                => null,
};

http_response_code(200);

import hmac
import hashlib
import json

def verify_webhook(request):
    payload = request.body
    signature = request.headers.get('X-Verilock-Signature', '')
    secret = os.environ['VERILOCK_WEBHOOK_SECRET']

    expected = hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        return HttpResponse(status=401)

    event = json.loads(payload)
    # Process event...
    return HttpResponse(status=200)

import crypto from 'crypto';

app.post('/webhooks/verilock', (req, res) => {
  const payload = JSON.stringify(req.body);
  const signature = req.headers['x-webhook-signature'];
  const secret = process.env.VERILOCK_WEBHOOK_SECRET;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(signature)
  )) {
    return res.status(401).send('Invalid signature');
  }

  // Process event...
  res.status(200).send('OK');
});