JavaScript

const crypto = require('crypto');
const secret = 'your_api_secret_key_here'; // Replace with your actual secret key
// Get the raw body of the request
const payload = req.body; // Assuming body-parser middleware is being used
const timestamp = req.headers['x-blaaiz-timestamp'];
const receivedSignature = req.headers['x-blaaiz-signature'];
if (!secret || !receivedSignature || !timestamp) {
    return res.status(400).send('Missing required parameters for signature verification.');
}
// Create the signature string
const signatureString = `${timestamp}.${JSON.stringify(payload)}`;
// Generate the expected signature using HMAC SHA-256
const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signatureString)
    .digest('hex');
// Compare the expected signature with the received signature
if (expectedSignature !== receivedSignature) {
    return res.status(401).send('Invalid signature. The webhook request may have been tampered with.');
}
// If we reach this point, the signature is valid
// Process the webhook payload