Receive card webhooks

import hmac
import hashlib
import json
from flask import Flask, request, abort

app = Flask(__name__)

BITNOB_SECRET = b'your_webhook_secret_here'

def verify_signature(raw_body, signature):
    expected = hmac.new(BITNOB_SECRET, raw_body, hashlib.sha512).hexdigest()
    return hmac.compare_digest(expected, signature)

@app.route("/webhook", methods=["POST"])
def handle_webhook():
    raw_body = request.get_data()
    signature = request.headers.get("x-bitnob-signature", "")

    if not verify_signature(raw_body, signature):
        abort(401, "Invalid signature")

    # Parse the raw body yourself: request.json rejects the
    # "application/json, application/json" Content-Type deliveries can carry
    event = json.loads(raw_body)
    print(f"Verified event: {event['event']}")
    return "", 200

const crypto = require('crypto');
const express = require('express');
const app = express();

const BITNOB_SECRET = 'your_webhook_secret_here';

// Read the raw bytes whatever Content-Type says: deliveries can arrive as
// "application/json, application/json", which type: 'application/json' rejects
app.post('/webhook', express.raw({ type: () => true }), (req, res) => {
  const rawBody = req.body;
  const signature = req.headers['x-bitnob-signature'] || '';

  const expected = crypto
    .createHmac('sha512', BITNOB_SECRET)
    .update(rawBody)
    .digest('hex');

  const valid =
    expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

  if (!valid) return res.status(401).send('Invalid signature');

  const event = JSON.parse(rawBody.toString('utf-8'));
  console.log(`Verified event: ${event.event}`);
  res.status(200).send();
});

app.listen(3000);