Webhooks

import hashlib
import hmac
import os

WEBHOOK_SECRET = os.environ["FOLIO_WEBHOOK_SECRET"]  # whsec_...

def verify_folio_signature(raw_body: bytes, signature_header: str) -> bool:
    # Parse t=<timestamp>,v1=<hex> from the header
    parts = dict(item.split("=", 1) for item in signature_header.split(",") if "=" in item)
    timestamp = parts.get("t", "")
    v1 = parts.get("v1", "")
    if not timestamp or not v1:
        return False
    # Recompute HMAC-SHA256 over "<timestamp>." + raw_body
    signed_payload = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        signed_payload,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, v1)

# In your request handler (e.g. Flask):
# raw_body = request.get_data()
# sig = request.headers.get("X-Signature", "")
# if not verify_folio_signature(raw_body, sig):
#     abort(403, "Invalid signature")

import * as crypto from "crypto";

const WEBHOOK_SECRET = process.env.FOLIO_WEBHOOK_SECRET!; // whsec_...

function verifyFolioSignature(rawBody: Buffer, signatureHeader: string): boolean {
  // Parse t=<timestamp>,v1=<hex> from the header
  const parts: Record<string, string> = {};
  for (const item of signatureHeader.split(",")) {
    const idx = item.indexOf("=");
    if (idx !== -1) parts[item.slice(0, idx)] = item.slice(idx + 1);
  }
  const timestamp = parts["t"] ?? "";
  const v1 = parts["v1"] ?? "";
  if (!timestamp || !v1) return false;
  // Recompute HMAC-SHA256 over "<timestamp>." + rawBody
  const signedPayload = Buffer.concat([Buffer.from(`${timestamp}.`), rawBody]);
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(signedPayload)
    .digest("hex");
  // constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(expected, "utf8"),
    Buffer.from(v1, "utf8"),
  );
}