Webhooks

{
  "id": "wh_1a2b3c4d5e6f7a8b",
  "event": "course.ready",
  "created_at": "2026-06-23T10:30:00Z",
  "api_version": "v1",
  "data": {
    "course_id": "20260623_103000_abc123",
    "title": "Sales Fundamentals",
    "status": "ready",
    "created_at": "2026-06-23T10:00:00Z",
    "sandbox": false,
    "module_count": 6
  }
}

import hmac
import hashlib
import time

def verify(request_body: bytes, signature_header: str, secret: str, tolerance_sec: int = 300) -> bool:
    parts = dict(p.split("=") for p in signature_header.split(","))
    t = parts["t"]
    v1 = parts["v1"]

    if abs(time.time() - int(t)) > tolerance_sec:
        return False

    signed = f"{t}.".encode() + request_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

const crypto = require('crypto');

function verify(rawBody, signatureHeader, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(
    signatureHeader.split(',').map(p => p.split('='))
  );
  const { t, v1 } = parts;

  if (Math.abs(Date.now() / 1000 - parseInt(t)) > toleranceSec) {
    return false;
  }

  const signed = `${t}.${rawBody}`;
  const expected = crypto.createHmac('sha256', secret).update(signed).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}