$secret   = $_ENV['PAYREQUEST_WEBHOOK_SECRET'];
$body     = file_get_contents('php://input');
$received = $_SERVER['HTTP_X_PAYREQUEST_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}

$event = json_decode($body, true);

import hashlib, hmac, os
from flask import request, abort

secret = os.environ['PAYREQUEST_WEBHOOK_SECRET'].encode()
body   = request.get_data()
sig    = request.headers.get('X-PayRequest-Signature', '')

expected = 'sha256=' + hmac.new(secret, body, hashlib.sha256).hexdigest()
if not hmac.compare_digest(expected, sig):
    abort(401)

event = request.get_json()

const crypto = require('crypto');

const secret = process.env.PAYREQUEST_WEBHOOK_SECRET;
const body   = req.rawBody; // use raw body, not parsed JSON
const sig    = req.headers['x-payrequest-signature'] ?? '';

const expected = 'sha256=' + crypto
  .createHmac('sha256', secret)
  .update(body)
  .digest('hex');

if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
  return res.status(401).send('Invalid signature');
}

const event = JSON.parse(body);