Verify webhook signatures

Every webhook carries two headers: Sourcedeck-Timestamp and Sourcedeck-Signature. The signature is an HMAC-SHA256 of the timestamp and the raw body, keyed with your endpoint’s signing secret.

import hmac, hashlib, time

def verify(secret: bytes, timestamp: str, body: bytes, signature: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:   # reject replays older than 5 minutes
        return False
    expected = hmac.new(secret, f"{timestamp}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)  # constant-time comparison

Reject any request that fails the check. Rotate the secret from Settings → Webhooks if you think it has leaked; the old one keeps working for 24 hours.