Webhook signature verification

Source → POST /api/webhook
         X-Signature: hmac-sha256(secret, body)
         X-Timestamp: <epoch>
Your handler:
  1. Read body
  2. Compute expected HMAC
  3. Constant-time-compare to header
  4. Reject if mismatch or timestamp too old (>5 min)
  5. Process

import crypto from "node:crypto";

const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET!;

function verifyWebhook(body: string, signature: string, timestamp: string): boolean {
  // Reject stale (replay protection)
  const age = Math.abs(Date.now() / 1000 - parseInt(timestamp));
  if (age > 300) return false;  // 5 minutes max

  const payload = `${timestamp}.${body}`;
  const expected = crypto.createHmac("sha256", WEBHOOK_SECRET).update(payload).digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

// In your handler
export async function POST(request: Request) {
  const body = await request.text();
  const signature = request.headers.get("X-Signature");
  const timestamp = request.headers.get("X-Timestamp");

  if (!signature || !timestamp || !verifyWebhook(body, signature, timestamp)) {
    return Response.json({ error: "invalid_signature" }, { status: 401 });
  }

  const data = JSON.parse(body);
  // ... process
}