Webhook Security

const crypto = require('crypto');

function computeHmac(secret, body, url) {
  const message = body + url;
  return crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');
}

// Add to request headers:
const signature = computeHmac(process.env.NBI_HMAC_SECRET, requestBody, requestUrl);
headers['X-Partner-Signature'] = signature;

import hmac
import hashlib

def compute_hmac(secret: str, body: str, url: str) -> str:
    message = (body + url).encode('utf-8')
    return hmac.new(
        secret.encode('utf-8'),
        message,
        hashlib.sha256
    ).hexdigest()

signature = compute_hmac(os.environ['NBI_HMAC_SECRET'], request_body, request_url)
headers['X-Partner-Signature'] = signature