Documentation

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  const sig = signature.replace('sha256=', '');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(sig)
  );
}

// Express example
app.post('/webhooks/bcm', (req, res) => {
  const raw = JSON.stringify(req.body);
  const sig = req.headers['x-bcm-signature'];
  if (!verifyWebhook(raw, sig, process.env.BCM_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  // Check timestamp to prevent replay
  const age = Date.now() - new Date(req.body.timestamp).getTime();
  if (age > 5 * 60 * 1000) {
    return res.status(400).send('Event too old');
  }
  console.log('Event:', req.body.event, req.body.data);
  res.status(200).send('OK');
});

import hmac, hashlib, json, time
from datetime import datetime

def verify_webhook(body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    sig = signature.replace('sha256=', '')
    return hmac.compare_digest(expected, sig)

# Flask example
@app.route('/webhooks/bcm', methods=['POST'])
def handle_webhook():
    raw = request.get_data()
    sig = request.headers.get('X-BCM-Signature', '')
    if not verify_webhook(raw, sig, os.environ['BCM_WEBHOOK_SECRET']):
        return 'Invalid signature', 401
    # Check timestamp to prevent replay
    payload = json.loads(raw)
    event_time = datetime.fromisoformat(payload['timestamp'].replace('Z', '+00:00'))
    age = (datetime.now(event_time.tzinfo) - event_time).total_seconds()
    if age > 300:
        return 'Event too old', 400
    print(f"Event: {payload['event']}", payload['data'])
    return 'OK', 200