X-FLTR-Signature: <hex-encoded-signature>

import hmac
import hashlib

def verify_webhook(secret, signature, body):
    expected = hmac.new(
        secret.encode(),
        body,
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

# Usage
if not verify_webhook(WEBHOOK_SECRET, signature, request.body):
    return {"error": "Invalid signature"}, 401

const crypto = require('crypto');

function verifyWebhook(secret, signature, body) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

if (!verifyWebhook(WEBHOOK_SECRET, signature, body)) {
  return res.status(401).json({ error: 'Invalid signature' });
}

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
)

func verifyWebhook(secret, signature string, body []byte) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))

    return hmac.Equal([]byte(signature), []byte(expected))
}

# ✅ Good
body = request.get_data()
verify_webhook(secret, signature, body)

# ❌ Bad
body = json.dumps(request.json)  # May not match

@app.route('/webhooks', methods=['POST'])
def webhook():
    # Verify
    if not verify_webhook(...):
        return {}, 401

    # Queue for processing
    queue.enqueue(process_webhook, request.json)

    # Return immediately
    return {}, 200

import hmac
import hashlib
import json

payload = {"event": "document.processed", "data": {}}
body = json.dumps(payload)

signature = hmac.new(
    b'whsec_test_secret',
    body.encode(),
    hashlib.sha256
).hexdigest()

print(f"X-FLTR-Signature: {signature}")

curl -X POST http://localhost:5000/webhooks \
  -H "Content-Type: application/json" \
  -H "X-FLTR-Signature: abc123..." \
  -d '{"event":"document.processed","data":{}}'

print(f"Received: {signature}")
print(f"Expected: {expected}")