Webhook

$secret = getenv('BGWA_WEBHOOK_SECRET');
$ts     = $_SERVER['HTTP_X_BGWA_TIMESTAMP'] ?? '';
$body   = file_get_contents('php://input');
$sig    = 'sha256=' . hash_hmac('sha256', $ts . '.' . $body, $secret);

if (! hash_equals($sig, $_SERVER['HTTP_X_BGWA_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit;
}
if (abs(time() - (int) $ts) > 300) {   // tolak bila lebih dari 5 menit
    http_response_code(400);
    exit;
}

$event = json_decode($body, true);
// proses $event['event'], $event['id'] ... lalu:
http_response_code(200);

import express from 'express';
import crypto from 'node:crypto';

const app = express();

// simpan body mentah untuk verifikasi
app.post('/hooks/bgwa', express.raw({ type: 'application/json' }), (req, res) => {
  const ts = req.get('X-BGWA-Timestamp') || '';
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.BGWA_WEBHOOK_SECRET)
    .update(ts + '.' + req.body.toString('utf8'))
    .digest('hex');

  const got = req.get('X-BGWA-Signature') || '';
  const ok = got.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(400);

  const event = JSON.parse(req.body.toString('utf8'));
  // proses event.event, event.id ...
  res.sendStatus(200);
});

import hmac, hashlib, os, time
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/hooks/bgwa")
def bgwa_hook():
    ts = request.headers.get("X-BGWA-Timestamp", "")
    body = request.get_data()  # byte mentah
    expected = "sha256=" + hmac.new(
        os.environ["BGWA_WEBHOOK_SECRET"].encode(),
        ts.encode() + b"." + body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, request.headers.get("X-BGWA-Signature", "")):
        abort(401)
    if abs(time.time() - int(ts or 0)) > 300:
        abort(400)

    event = request.get_json()
    # proses event["event"], event["id"] ...
    return "", 200