Webhook Verification

signature = hex(hmac_sha256(secret, timestamp + "." + raw_request_body))

const crypto = require('crypto');

function verifyPagorampWebhook(rawBody, timestamp, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // Constant-time comparison to avoid timing attacks.
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(signature, 'hex'),
  );
}

// Express example
app.post('/webhooks/pagoramp', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-pagoramp-signature'];
  const timestamp = req.headers['x-pagoramp-timestamp'];
  const rawBody = req.body.toString('utf8');

  if (!verifyPagorampWebhook(rawBody, timestamp, signature, process.env.PAGORAMP_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(rawBody);
  // ... handle event
  res.status(200).send('ok');
});