Webhooks Setup

const crypto = require('crypto');

function verifySignature(signature, timestamp, rawBody, publicKeyPem) {
  const payload = `${timestamp}:${rawBody}`;
  const hash = crypto.createHash('sha256').update(payload).digest();

  const verifier = crypto.createVerify('RSA-SHA256');
  verifier.update(hash); // pass the digest, not the raw payload
  verifier.end();

  return verifier.verify(publicKeyPem, signature, 'base64');
}

// Usage (Express, with the raw body preserved)
const isValid = verifySignature(
  req.headers['x-crown-signature'],
  req.headers['x-request-timestamp'],
  rawBody,
  publicKey,
);

import hashlib
import base64
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding

def verify_signature(signature, timestamp, raw_body, public_key):
    payload = f"{timestamp}:{raw_body}"
    payload_hash = hashlib.sha256(payload.encode()).digest()
    try:
        public_key.verify(
            base64.b64decode(signature),
            payload_hash,  # re-hashed by verify() -> effective double SHA256
            padding.PKCS1v15(),
            hashes.SHA256(),
        )
        return True
    except Exception:
        return False