import { Webhook } from "standardwebhooks";const wh = new Webhook(process.env.WEBHOOK_SECRET!);app.post(  "/webhooks/pandabase",  express.raw({ type: "application/json" }),  (req, res) => {    try {      const event = wh.verify(req.body.toString(), req.headers as any);      // event is the parsed JSON body, signature already verified      switch (event.event) {        case "PAYMENT_COMPLETED":          console.log(`Payment completed for order ${event.data.order.id}`);          break;        case "PAYMENT_REFUNDED":          console.log(`Refund issued for order ${event.data.order.id}`);          break;      }      res.status(200).send("OK");    } catch {      res.status(401).send("Invalid signature");    }  },);

from standardwebhooks import Webhookfrom flask import Flask, request, jsonifyapp = Flask(__name__)wh = Webhook(WEBHOOK_SECRET)@app.route("/webhooks/pandabase", methods=["POST"])def handle_webhook():    try:        event = wh.verify(request.data, dict(request.headers))    except Exception:        return jsonify(error="Invalid signature"), 401    if event["event"] == "PAYMENT_COMPLETED":        print(f"Payment completed for order {event['data']['order']['id']}")    return jsonify(message="OK"), 200

import standardwebhooks "github.com/standard-webhooks/standard-webhooks/libraries/go"wh, _ := standardwebhooks.NewWebhook(webhookSecret)func webhookHandler(w http.ResponseWriter, r *http.Request) {    body, _ := io.ReadAll(r.Body)    if err := wh.Verify(body, r.Header); err != nil {        http.Error(w, "Invalid signature", http.StatusUnauthorized)        return    }    // body is verified — parse and dispatch    w.WriteHeader(http.StatusOK)}

import crypto from "node:crypto";const TOLERANCE_MS = 5 * 60 * 1000;function verifyWebhook(  headers: Record<string, string>,  rawBody: string,  secret: string,): boolean {  const msgId = headers["webhook-id"];  const timestamp = headers["webhook-timestamp"];  const signatureHeader = headers["webhook-signature"];  if (!msgId || !timestamp || !signatureHeader) return false;  // Webhook-Signature is a space-separated list of `vN,<base64>` entries.  // We only need to match one.  const signatures = signatureHeader    .split(" ")    .filter((s) => s.startsWith("v1,"))    .map((s) => s.slice(3));  const signedPayload = `${msgId}.${timestamp}.${rawBody}`;  const expected = crypto    .createHmac("sha256", secret)    .update(signedPayload)    .digest("base64");  const valid = signatures.some(    (sig) =>      sig.length === expected.length &&      crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)),  );  if (!valid) return false;  const skewMs = Math.abs(Date.now() - Number(timestamp) * 1000);  return skewMs <= TOLERANCE_MS;}

import hmac, hashlib, base64, timeTOLERANCE_MS = 5 * 60 * 1000def verify(headers, raw_body: bytes, secret: str) -> bool:    msg_id = headers.get("webhook-id")    timestamp = headers.get("webhook-timestamp")    sig_header = headers.get("webhook-signature")    if not msg_id or not timestamp or not sig_header:        return False    signed_payload = f"{msg_id}.{timestamp}.{raw_body.decode()}".encode()    expected = base64.b64encode(        hmac.new(secret.encode(), signed_payload, hashlib.sha256).digest()    ).decode()    sigs = [s[3:] for s in sig_header.split(" ") if s.startswith("v1,")]    if not any(hmac.compare_digest(s, expected) for s in sigs):        return False    skew_ms = abs(int(time.time() * 1000) - int(timestamp) * 1000)    return skew_ms <= TOLERANCE_MS

package webhookimport (    "crypto/hmac"    "crypto/sha256"    "encoding/base64"    "net/http"    "strconv"    "strings"    "time")const toleranceMs = 5 * 60 * 1000func Verify(h http.Header, rawBody []byte, secret string) bool {    msgID := h.Get("Webhook-Id")    ts := h.Get("Webhook-Timestamp")    sigHeader := h.Get("Webhook-Signature")    if msgID == "" || ts == "" || sigHeader == "" {        return false    }    mac := hmac.New(sha256.New, []byte(secret))    mac.Write([]byte(msgID + "." + ts + "." + string(rawBody)))    expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))    matched := false    for _, entry := range strings.Split(sigHeader, " ") {        if !strings.HasPrefix(entry, "v1,") {            continue        }        if hmac.Equal([]byte(entry[3:]), []byte(expected)) {            matched = true            break        }    }    if !matched {        return false    }    tsSec, err := strconv.ParseInt(ts, 10, 64)    if err != nil {        return false    }    skew := time.Now().UnixMilli() - tsSec*1000    if skew < 0 {        skew = -skew    }    return skew <= toleranceMs}