HMAC Signature Validation

import hmac
import hashlib
import base64
import json

def verify_webhook_signature(payload_body, received_signature, secret_key):
    """
    Verify the HMAC-SHA256 signature of a Flinks webhook.

    Args:
        payload_body: The raw request body (bytes)
        received_signature: The signature from the webhook header
        secret_key: Your HMAC secret key from Flinks

    Returns:
        True if the signature is valid, False otherwise
    """
    # Compute the expected signature
    computed_hash = hmac.new(
        secret_key.encode('utf-8'),
        payload_body,
        hashlib.sha256
    ).digest()

    computed_signature = base64.b64encode(computed_hash).decode('utf-8')

    # Compare signatures using constant-time comparison
    return hmac.compare_digest(computed_signature, received_signature)

from flask import Flask, request, jsonify
import hmac
import hashlib
import base64

app = Flask(__name__)
HMAC_SECRET = "your-hmac-secret-key"

@app.route("/webhook", methods=["POST"])
def handle_webhook():
    # Get the signature from the request header
    received_signature = request.headers.get("flinks-authenticity-key", "")

    # Get the raw request body
    payload_body = request.get_data()

    # Compute the expected signature
    computed_hash = hmac.new(
        HMAC_SECRET.encode("utf-8"),
        payload_body,
        hashlib.sha256
    ).digest()
    computed_signature = base64.b64encode(computed_hash).decode("utf-8")

    # Verify the signature
    if not hmac.compare_digest(computed_signature, received_signature):
        return jsonify({"error": "Invalid signature"}), 403

    # Process the webhook payload
    data = request.get_json()
    response_type = data.get("ResponseType")

    if response_type == "KYC":
        # Handle KYC webhook
        pass
    elif response_type == "GetAccountsDetail":
        # Handle account detail webhook
        pass

    # Return 200 to acknowledge receipt
    return jsonify({"status": "ok"}), 200

const crypto = require('crypto');

function verifyWebhookSignature(payloadBody, receivedSignature, secretKey) {
  const computedHash = crypto
    .createHmac('sha256', secretKey)
    .update(payloadBody)
    .digest('base64');

  // Use timingSafeEqual for constant-time comparison
  const expected = Buffer.from(computedHash, 'utf8');
  const received = Buffer.from(receivedSignature, 'utf8');

  if (expected.length !== received.length) {
    return false;
  }

  return crypto.timingSafeEqual(expected, received);
}

const express = require('express');
const crypto = require('crypto');

const app = express();
const HMAC_SECRET = 'your-hmac-secret-key';

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const receivedSignature = req.headers['flinks-authenticity-key'] || '';
  const payloadBody = req.body;

  // Compute the expected signature
  const computedHash = crypto
    .createHmac('sha256', HMAC_SECRET)
    .update(payloadBody)
    .digest('base64');

  // Verify using constant-time comparison
  const expected = Buffer.from(computedHash, 'utf8');
  const received = Buffer.from(receivedSignature, 'utf8');

  if (expected.length !== received.length || !crypto.timingSafeEqual(expected, received)) {
    return res.status(403).json({ error: 'Invalid signature' });
  }

  // Process the webhook payload
  const data = JSON.parse(payloadBody);
  const responseType = data.ResponseType;

  if (responseType === 'KYC') {
    // Handle KYC webhook
  } else if (responseType === 'GetAccountsDetail') {
    // Handle account detail webhook
  }

  // Return 200 to acknowledge receipt
  res.status(200).json({ status: 'ok' });
});

https://[instance]-iframe.private.fin.ag/v2/?tag=userId%3D12345%2Csession%3Dabc&redirectUrl=https://example.com/callback

{
  "Tag": "userId=12345,session=abc",
  "ResponseType": "GetAccountsDetail",
  "HttpStatusCode": 200,
  "Login": {
    "Id": "f5d5f008-e529-4714-21c0-08d6abf5bce4"
  },
  "Accounts": []
}