Overview

function validateWebhook($payload, $signature, $salt) {
    $computedSignature = hash_hmac('sha256', $payload, $salt);
    return hash_equals($computedSignature, $signature);
}

// Usage
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_HITPAY_SIGNATURE'];
$salt = 'your_salt_from_dashboard';

if (validateWebhook($payload, $signature, $salt)) {
    $data = json_decode($payload, true);
    // Process the payment confirmation
    // Mark order as paid
} else {
    http_response_code(401);
    exit('Invalid signature');
}

const crypto = require('crypto');

function validateWebhook(payload, signature, salt) {
    const computedSignature = crypto
        .createHmac('sha256', salt)
        .update(payload)
        .digest('hex');
    return crypto.timingSafeEqual(
        Buffer.from(computedSignature),
        Buffer.from(signature)
    );
}

// Usage in Express
app.post('/webhook', (req, res) => {
    const payload = JSON.stringify(req.body);
    const signature = req.headers['hitpay-signature'];
    const salt = 'your_salt_from_dashboard';

    if (validateWebhook(payload, signature, salt)) {
        // Process the payment confirmation
        // Mark order as paid
        res.status(200).send('OK');
    } else {
        res.status(401).send('Invalid signature');
    }
});