Webhook Signature Verification

3min
Overview
Code examples that can be used to verify a webhook signature using a signing key.
Python
Python
# Python
import json
import hashlib
import hmac
from time import time

def verify_webhook_signature(body: dict, headers: dict, signing_key: str) -> bool:
	now = int(time())
	payload = json.dumps(body, separators=(",", ":"))
	incoming_signature = headers.get("X-Butter-Webhook-Signature")
	expires_at = headers.get("X-Butter-Webhook-Expires")
	message = f"{payload}+{expires_at}".encode("utf-8")
	signature = hmac.new(signing_key.encode("utf-8"), message, hashlib.sha256).hexdigest()
	if signature != incoming_signature:
		return False
	if expires_at < now:
		return False
	return True

# Python
import json
import hashlib
import hmac
from time import time

def verify_webhook_signature(body: dict, headers: dict, signing_key: str) -> bool:
	now = int(time())
	payload = json.dumps(body, separators=(",", ":"))
	incoming_signature = headers.get("X-Butter-Webhook-Signature")
	expires_at = headers.get("X-Butter-Webhook-Expires")
	message = f"{payload}+{expires_at}".encode("utf-8")
	signature = hmac.new(signing_key.encode("utf-8"), message, hashlib.sha256).hexdigest()
	if signature != incoming_signature:
		return False
	if expires_at < now:
		return False
	return True
﻿
JavaScript
Text
// JavaScript
const crypto = require('crypto');

function verifyWebhookSignature(body, headers, signingKey) {
	const now = Math.floor(new Date().getTime()/1000);
	const payload = JSON.stringify(body);
	const expiresAt = headers["X-Butter-Webhook-Expires"];
	const incomingSignature = headers["X-Butter-Webhook-Signature"];
	const hmac = crypto.createHmac('SHA256', signingKey);
	const data = hmac.update(Buffer.from(`${JSON.stringify(body)}+${expiresAt}`));
	const signature = data.digest('hex');
	if(signature != incomingSignature) return false;
	if(expiresAt < now) return false;
	return true;
}
// JavaScript
const crypto = require('crypto');

function verifyWebhookSignature(body, headers, signingKey) {
	const now = Math.floor(new Date().getTime()/1000);
	const payload = JSON.stringify(body);
	const expiresAt = headers["X-Butter-Webhook-Expires"];
	const incomingSignature = headers["X-Butter-Webhook-Signature"];
	const hmac = crypto.createHmac('SHA256', signingKey);
	const data = hmac.update(Buffer.from(`${JSON.stringify(body)}+${expiresAt}`));
	const signature = data.digest('hex');
	if(signature != incomingSignature) return false;
	if(expiresAt < now) return false;
	return true;
}
﻿
﻿
Updated 10 Dec 2024
Did this page help you?
Recover Payment Object Properties
Payments