Webhooks Documentation

const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  const actual = signature.replace('sha256=', '');

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(actual)
  );
}

// In your webhook handler:
app.post('/webhooks/rateapi', (req, res) => {
  const signature = req.headers['x-rateapi-signature'];
  const timestamp = req.headers['x-rateapi-timestamp'];

  // Reject old webhooks (> 5 minutes)
  if (Date.now() / 1000 - timestamp > 300) {
    return res.status(401).send('Expired');
  }

  if (!verifySignature(req.rawBody, signature, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Process webhook...
});

import hmac
import hashlib
import time

def verify_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    actual = signature.replace('sha256=', '')

    return hmac.compare_digest(expected, actual)

# In your webhook handler:
from flask import Flask, request

@app.route('/webhooks/rateapi', methods=['POST'])
def webhook_handler():
    signature = request.headers.get('X-RateAPI-Signature')
    timestamp = request.headers.get('X-RateAPI-Timestamp')

    # Reject old webhooks (> 5 minutes)
    if time.time() - int(timestamp) > 300:
        return 'Expired', 401

    if not verify_signature(
        request.data.decode(),
        signature,
        WEBHOOK_SECRET
    ):
        return 'Invalid signature', 401

    # Process webhook...