Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();

// Capture the raw body, not parsed JSON
app.post(
  "/webhooks/barker",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("x-barker-signature");
    const expected = crypto
      .createHmac("sha256", process.env.BARKER_WEBHOOK_SECRET)
      .update(req.body)              // Buffer, raw
      .digest("hex");

    // Constant-time comparison to prevent timing attacks
    if (
      !signature ||
      signature.length !== expected.length ||
      !crypto.timingSafeEqual(
        Buffer.from(signature),
        Buffer.from(expected),
      )
    ) {
      return res.status(401).send("invalid signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    const eventType = req.header("x-barker-event");
    handleEvent(eventType, event);
    res.sendStatus(200);
  },
);

import hmac
import hashlib
import os
from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
SECRET = os.environ["BARKER_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/barker")
async def barker_webhook(
    request: Request,
    x_barker_signature: str = Header(...),
    x_barker_event: str = Header(...),
):
    body = await request.body()
    expected = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, x_barker_signature):
        raise HTTPException(401, "invalid signature")
    event = await request.json()
    handle_event(x_barker_event, event)
    return {"ok": True}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "os"
)

func barkerWebhook(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    sig := r.Header.Get("X-Barker-Signature")

    mac := hmac.New(sha256.New, []byte(os.Getenv("BARKER_WEBHOOK_SECRET")))
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expected), []byte(sig)) {
        http.Error(w, "invalid signature", http.StatusUnauthorized)
        return
    }
    eventType := r.Header.Get("X-Barker-Event")
    handleEvent(eventType, body)
    w.WriteHeader(http.StatusOK)
}

SECRET="your_webhook_secret"
BODY='{"slug":"acme-usdc-base","current_apy":0.048}'
echo -n "$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex