Webhooks Overview

...
StringBuilder valueToDigest = new StringBuilder();

String payload = ""; //webhook payload

// Get the timestamp, signature from header
String timestamp = request.getHeader("x-wk-timestamp");
String signature = request.getHeader("x-wk-signature");

valueToDigest.append(payload);
valueToDigest.append(timestamp);

// Get your secret
String secret = getSecret();

String signatureHex = HmacUtils.hmacSha512Hex(secret, valueToDigest.toString())
...

<?php
...
  $timestamp = $request->getHeaderLine('x-wk-timestamp');
  $payload = $request->getBody()->getContents();

  $secret = <your signatuer secret>;
  $signature = $request->getHeaderLine('x-wk-signature');

  if (hash_hmac('sha512', $payload.$timestamp, $secret) != $signature) {
  	return new Response(400, array(), 'failed to verify the signature');
  }

  // Do something with event
  return new Response(200, array(), $body);
}

use ring::hmac;

fn verify_signature(payload: &str, timestamp: &str, received_signature: &str, secret: &str) -> bool {
    let key = hmac::Key::new(hmac::HMAC_SHA512, secret.as_bytes());
    let value_to_digest = format!("{}{}", payload, timestamp);
    let signature = hmac::sign(&key, value_to_digest.as_bytes());
    let signature_hex = hex::encode(signature.as_ref());

    signature_hex == received_signature
}

fn main() {
    let payload = ""; // Your webhook payload here
    let secret = "<YOUR_WEBHOOK_SECRET>";
    let timestamp = "x-wk-timestamp header value here";
    let received_signature = "x-wk-signature header value here";

    if verify_signature(payload, timestamp, received_signature, secret) {
        println!("Signature verified!");
    } else {
        println!("Signature verification failed!");
    }
}

// Koa example. Configure middleware to retain the exact raw request body.
const crypto = require('crypto')

const secret = '<YOUR_WEBHOOK_SECRET>'

async webhookController(ctx, next) {
  // webhook is received

  const { headers, rawBody } = ctx.request
  const timestamp = headers['x-wk-timestamp']

  // rawBody must be the exact JSON string received, before parsing or reformatting.
  const payload = rawBody + timestamp

  const signatureHex = crypto.createHmac('sha512', secret).update(payload).digest('hex')

  if (signatureHex === headers['x-wk-signature']) {
    // do business logic after signature is verified

    return next() // http response code = 200: ack the webhook
  } else {
    ctx.status = 500
    ctx.body = 'failed to verify webhook signature'
    return
  }
}