Build with Axlaas

HMAC-SHA256 Signature Verification

// Node.js / TypeScript
import crypto from 'crypto';

function verifyWebhook(
  payload: string,
  signature: string,
  secret: string
): boolean {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your webhook handler:
app.post('/webhooks/axlaas', (req, res) => {
  const sig = req.headers['x-axlaas-signature'];
  const valid = verifyWebhook(
    JSON.stringify(req.body),
    sig,
    process.env.WEBHOOK_SECRET
  );
  if (!valid) return res.status(401).send('Invalid');
  // Process event...
  res.status(200).send('OK');
});