Webhooks que realmente entregam

{
  "event":         "submission.created",
  "delivery_id":   "dlv_8aE2kF1Ld9zQ",
  "timestamp":     1730723400,
  "form_id":       "f_142",
  "submission_id": "s_9k3XnPq72T",
  "fields": {
    "name":    "Sarah Chen",
    "email":   "[email protected]",
    "company": "Acme Corp",
    "budget":  25000,
    "message": "Looking for a form solution..."
  },
  "payment": {
    "status":   "succeeded",
    "amount":   2500,
    "currency": "usd"
  },
  "meta": {
    "ip":         "203.0.113.42",
    "user_agent": "Mozilla/5.0...",
    "locale":     "en"
  }
}

const crypto = require('crypto');

function verify(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

function verify($rawBody, $signature, $secret) {
    $expected = hash_hmac('sha256', $rawBody, $secret);
    return hash_equals($expected, $signature);
}

import hmac, hashlib

def verify(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)