Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyBiz Invoice PaySignature(secret, signatureHeader, rawBody, toleranceSec = 300) {
  const match = /^t=(\d+),v1=([a-f0-9]+)$/.exec(signatureHeader || "");
  if (!match) return false;
  const timestamp = Number(match[1]);
  // Replay protection: reject stale signatures.
  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSec) return false;
  const expected = `t=${timestamp},v1=${createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex")}`;
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader);
  return a.length === b.length && timingSafeEqual(a, b);
}

// In your route handler (use the RAW body, before JSON parsing):
// const ok = verifyBiz Invoice PaySignature(process.env.INVOICLY_WEBHOOK_SECRET,
//   req.headers["invoicly-signature"], rawBody);
// if (!ok) return res.status(401).send("bad signature");

<?php
function verify_invoicly_signature(string $secret, ?string $header, string $rawBody, int $toleranceSec = 300): bool {
  if (!preg_match('/^t=(\d+),v1=([a-f0-9]+)$/', (string) $header, $m)) {
    return false;
  }
  $timestamp = (int) $m[1];
  // Replay protection: reject stale signatures.
  if (abs(time() - $timestamp) > $toleranceSec) {
    return false;
  }
  $expected = "t={$timestamp},v1=" . hash_hmac("sha256", "{$timestamp}.{$rawBody}", $secret);
  return hash_equals($expected, (string) $header); // constant-time compare
}

// $rawBody = file_get_contents("php://input");
// if (!verify_invoicly_signature(getenv("INVOICLY_WEBHOOK_SECRET"),
//     $_SERVER["HTTP_INVOICLY_SIGNATURE"] ?? null, $rawBody)) {
//   http_response_code(401); exit("bad signature");
// }