SMS and call webhooks: your texts and calls, as signed JSON

import crypto from 'node:crypto';

export function verify(rawBody, header, secret) {
  const p = Object.fromEntries(header.split(',').map((s) => s.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false;
  const expected = crypto.createHmac('sha256', secret)
    .update(`${p.t}.${rawBody}`).digest('hex');
  return p.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(p.v1), Buffer.from(expected));
}

import hashlib, hmac, time

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    p = dict(part.split("=", 1) for part in header.split(","))
    if abs(time.time() - int(p.get("t", 0))) > 300:
        return False
    signed = p["t"].encode() + b"." + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, p.get("v1", ""))

function verify(string $rawBody, string $header, string $secret): bool
{
    parse_str(str_replace(',', '&', $header), $p);
    if (abs(time() - (int) ($p['t'] ?? 0)) > 300) {
        return false;
    }
    $expected = hash_hmac('sha256', ($p['t'] ?? '') . '.' . $rawBody, $secret);
    return hash_equals($expected, (string) ($p['v1'] ?? ''));
}