Webhook Signature

Module providing webhook signature utilities for HMAC SHA-256 verification.

This module provides utilities for generating and verifying HMAC SHA-256 signatures for webhook requests. This ensures that webhook requests are authentic and haven't been tampered with during transmission.

generate_webhook_signature_with_timestamp(payload, secret, timestamp)

Generate HMAC SHA-256 signature with timestamp for webhook payload.

This function creates a signature that includes a timestamp, which helps prevent replay attacks. The timestamp is prepended to the payload before signing.

Parameters:

Name	Type	Description	Default
payload	str | bytes	The webhook payload to sign.	required
secret	str	The shared secret key used for signing.	required
timestamp	str	Unix timestamp (in seconds) as a string.	required

Returns:

Name	Type	Description
str	str	The hexadecimal representation of the HMAC SHA-256 signature.

verify_webhook_signature_with_timestamp(payload, secret, received_signature, timestamp, tolerance_seconds=300)

Verify HMAC SHA-256 signature with timestamp for webhook payload.

This function verifies the signature and checks that the timestamp is within the acceptable tolerance window. This prevents replay attacks where an attacker could intercept and resend old webhook requests.

Parameters:

Name	Type	Description	Default
payload	str | bytes	The webhook payload to verify.	required
secret	str	The shared secret key used for verification.	required
received_signature	str	The signature received in the webhook request.	required
timestamp	str	The timestamp received in the webhook request.	required
tolerance_seconds	int	Maximum age of the webhook in seconds. Defaults to 300 (5 minutes).	300

Returns:

Name	Type	Description
bool	bool	True if the signature is valid and timestamp is within tolerance, False otherwise.