Webhooks

Headers: X-HandleIt-Signature, X-HandleIt-Delivery (stable id, for dedup), X-HandleIt-Event.

The signature is HMAC-SHA256 over <timestamp>.<raw body>, formatted t=<ts>,v1=<hex>. Reject anything older than 300 seconds. Delivery is at-least-once with exponential backoff, so dedup on the delivery id.

import hashlib, hmac, time

def verify(secret: str, header: str, body: bytes, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    ts, got = int(parts["t"]), parts["v1"]
    if abs(int(time.time()) - ts) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{ts}.".encode() + body,
                        hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, got)