Webhooks

{
  "id": "evt_1234567890",
  "type": "student.completed_course",
  "created": 1633024800,
  "data": {
    "student_id": "stu_abc123",
    "student_email": "student@example.com",
    "course_id": "course_xyz789",
    "course_title": "Introduction to Python",
    "completed_at": "2025-10-11T14:30:00Z",
    "final_score": 92.5,
    "time_spent_minutes": 480
  },
  "account_id": "acct_demo"
}

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const [timestamp, hash] = signature.split(',')
    .map(part => part.split('=')[1]);

  const signedPayload = `${timestamp}.${JSON.stringify(payload)}`;
  const expectedHash = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(hash),
    Buffer.from(expectedHash)
  );
}

import hmac
import hashlib
import json

def verify_webhook(payload, signature, secret):
    parts = dict(part.split('=') for part in signature.split(','))
    timestamp = parts['t']
    received_hash = parts['v1']

    signed_payload = f"{timestamp}.{json.dumps(payload)}"
    expected_hash = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(received_hash, expected_hash)