Webhooks

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const app = express();
const secret = process.env.TWICE_WEBHOOK_SECRET;

// Raw body — the signature covers the exact bytes TWICE sent
app.post('/webhooks/order-created', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + createHmac('sha256', secret).update(req.body).digest('hex');
  const signature = req.get('X-Twice-Signature');
  const isValid =
    typeof signature === 'string' &&
    signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

  if (!isValid) return res.status(401).send('Invalid signature');

  const event = JSON.parse(req.body.toString('utf8'));
  handleOrderCreated(event.eventId, event.data);
  res.status(200).send('OK');
});

app.listen(3000);

import hmac, hashlib, json, os
from flask import Flask, request

app = Flask(__name__)
secret = os.environ['TWICE_WEBHOOK_SECRET']

@app.post('/webhooks/order-created')
def order_created():
    raw_body = request.get_data()
    expected = 'sha256=' + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    signature = request.headers.get('X-Twice-Signature', '')

    if not hmac.compare_digest(signature, expected):
        return ('Invalid signature', 401)

    event = json.loads(raw_body)
    handle_order_created(event['eventId'], event['data'])
    return ('OK', 200)