Webhook

{
  "event": "message.received",
  "id": "1042-7",
  "created_at": 1793857502513,
  "office_id": "4611686018507324416",
  "thread": {
    "id": "1042",
    "customer_name": "คุณสมหญิง",
    "tags": ["VIP"],
    "note": "ชอบรับของช่วงเช้า"
  },
  "message": {
    "id": 7,
    "sent_at": 1793857502513,
    "from": "customer",
    "type": "text",
    "text": "ขนมชั้นวันนี้เหลือไหมคะ",
    "file": null,
    "location": null
  }
}

import crypto from 'node:crypto';

function verify(rawBody, timestamp, signature, secret) {
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = 'v1=' + crypto.createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signature || '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hashlib, hmac, time

def verify(raw_body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:
        return False
    message = timestamp.encode() + b"." + raw_body
    expected = "v1=" + hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature or "")

<?php
function verify(string $raw, string $timestamp, string $signature, string $secret): bool {
    if (abs(time() - (int) $timestamp) > 300) return false;
    $expected = 'v1=' . hash_hmac('sha256', $timestamp . '.' . $raw, $secret);
    return hash_equals($expected, $signature);
}