Webhooks

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.ORDSTAGE_WEBHOOK_SECRET; // whsec_…
const TOLERANCE_SECONDS = 300;

export function verifyOrdstageSignature(secret, timestamp, deliveryId, rawBody, signature, now = Date.now() / 1000) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret)
    .update(`${timestamp}.${deliveryId}.`)
    .update(rawBody)
    .digest("hex");
  const given = Buffer.from(String(signature ?? ""));
  const fresh = Math.abs(now - Number(timestamp)) <= TOLERANCE_SECONDS;
  return fresh && given.length === expected.length && crypto.timingSafeEqual(given, Buffer.from(expected));
}

const app = express();
// express.raw keeps the exact bytes Ordstage signed.
app.post("/webhooks/ordstage", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyOrdstageSignature(SECRET, req.get("X-Ordstage-Timestamp"), req.get("X-Ordstage-Delivery"),
    req.body, req.get("X-Ordstage-Signature"));
  if (!ok) return res.sendStatus(400);
  const event = JSON.parse(req.body.toString("utf8"));
  res.sendStatus(200);
  // handle event.event / event.data here, skipping event.id values you've already seen
});
app.listen(3000);

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

SECRET = os.environ["ORDSTAGE_WEBHOOK_SECRET"]  # whsec_…
TOLERANCE_SECONDS = 300


def verify_ordstage_signature(secret, timestamp, delivery_id, raw_body, signature, now=None):
    expected = "sha256=" + hmac.new(secret.encode("utf-8"), f"{timestamp}.{delivery_id}.".encode("utf-8") + raw_body,
                                    hashlib.sha256).hexdigest()
    try:
        fresh = abs((now if now is not None else time.time()) - int(timestamp)) <= TOLERANCE_SECONDS
    except (TypeError, ValueError):
        return False
    return fresh and hmac.compare_digest(expected, signature or "")


app = Flask(__name__)


@app.post("/webhooks/ordstage")
def ordstage_webhook():
    raw = request.get_data()  # the exact bytes Ordstage signed
    if not verify_ordstage_signature(SECRET, request.headers.get("X-Ordstage-Timestamp"),
                                     request.headers.get("X-Ordstage-Delivery"), raw,
                                     request.headers.get("X-Ordstage-Signature")):
        abort(400)
    event = json.loads(raw)
    # handle event["event"] / event["data"] here, skipping event["id"] values you've already seen
    return "", 200

<?php
const TOLERANCE_SECONDS = 300;

function verify_ordstage_signature(string $secret, string $timestamp, string $deliveryId, string $rawBody, string $signature, ?int $now = null): bool
{
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $deliveryId . '.' . $rawBody, $secret);
    $fresh = ctype_digit($timestamp) && abs(($now ?? time()) - (int) $timestamp) <= TOLERANCE_SECONDS;
    return $fresh && hash_equals($expected, $signature);
}

$secret = getenv('ORDSTAGE_WEBHOOK_SECRET'); // whsec_…
$raw = file_get_contents('php://input'); // the exact bytes Ordstage signed
$ok = verify_ordstage_signature(
    $secret,
    $_SERVER['HTTP_X_ORDSTAGE_TIMESTAMP'] ?? '',
    $_SERVER['HTTP_X_ORDSTAGE_DELIVERY'] ?? '',
    $raw,
    $_SERVER['HTTP_X_ORDSTAGE_SIGNATURE'] ?? ''
);
if (!$ok) {
    http_response_code(400);
    exit;
}
$event = json_decode($raw, true);
http_response_code(200);
// handle $event['event'] / $event['data'] here, skipping $event['id'] values you've already seen