Webhooks

Verifying Webhook Signatures

Each webhook delivery includes an X-BSM-Signature header. Verify it using HMAC-SHA256:

import hmac, hashlib

def verify(secret, timestamp, body, signature):
    msg = f"{timestamp}.{body}"
    expected = hmac.new(
        secret.encode(), msg.encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)