Webhooks

{"type":"webhook.test","timestamp":"2026-10-01T12:00:00.000Z","data":{"webhookId":"0199a0b9-1f2e-7a3b-8c4d-5e6f7a8b9c0d"}}

import { Webhook } from 'standardwebhooks';

/**
 * The event, parsed, when `rawBody` was signed by Meles with `secret` within five minutes;
 * otherwise it throws WebhookVerificationError. Pass the body exactly as it arrived, before any
 * JSON parsing, and the request's headers: webhook-id, webhook-timestamp and webhook-signature.
 */
export function verifyWebhook(rawBody, headers, secret) {
  return new Webhook(secret).verify(rawBody, headers);
}

app.post('/webhooks/meles', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = verifyWebhook(req.body, req.headers, process.env.MELES_WEBHOOK_SECRET);
  } catch {
    return res.sendStatus(400);
  }
  // Deduplicate on req.headers['webhook-id'], then handle event.type.
  res.sendStatus(204);
});

from standardwebhooks import Webhook


def verify_webhook(raw_body: bytes, headers: dict, secret: str):
    """The event, parsed, when raw_body was signed by Meles with secret within five minutes.

    Otherwise raises standardwebhooks.WebhookVerificationError. Pass the body exactly as it
    arrived, before any JSON parsing, and the request's headers: webhook-id,
    webhook-timestamp and webhook-signature.
    """
    return Webhook(secret).verify(raw_body, headers)

@app.post("/webhooks/meles")
def meles():
    try:
        event = verify_webhook(request.get_data(), dict(request.headers), os.environ["MELES_WEBHOOK_SECRET"])
    except WebhookVerificationError:
        return "", 400
    # Deduplicate on request.headers["webhook-id"], then handle event["type"].
    return "", 204

using System.Globalization;
using System.Security.Cryptography;
using System.Text;

/// <summary>Verifies a Meles webhook: copy this class into your receiver.</summary>
internal static class MelesWebhooks
{
    /// <summary>How far a webhook's timestamp may be from your clock, either way.</summary>
    public static readonly TimeSpan Tolerance = TimeSpan.FromMinutes(5);

    /// <summary>
    /// True when <paramref name="body"/>, the request's body exactly as it arrived, was signed by
    /// Meles with <paramref name="secret"/> (whsec_…) within <see cref="Tolerance"/> of
    /// <paramref name="now"/>. Parse the JSON only after this returns true.
    /// </summary>
    public static bool Verify(byte[] body, IReadOnlyDictionary<string, string> headers, string secret, DateTimeOffset now)
    {
        if (!headers.TryGetValue("webhook-id", out var id)
            || !headers.TryGetValue("webhook-timestamp", out var sent)
            || !headers.TryGetValue("webhook-signature", out var signatures)
            || !long.TryParse(sent, NumberStyles.None, CultureInfo.InvariantCulture, out var seconds)
            || (now - DateTimeOffset.FromUnixTimeSeconds(seconds)).Duration() > Tolerance)
        {
            return false;
        }

        var key = Convert.FromBase64String(secret.StartsWith("whsec_", StringComparison.Ordinal) ? secret[6..] : secret);
        var signed = Encoding.UTF8.GetBytes($"{id}.{sent}.").Concat(body).ToArray();
        var expected = HMACSHA256.HashData(key, signed);
        foreach (var signature in signatures.Split(' '))
        {
            if (signature.StartsWith("v1,", StringComparison.Ordinal)
                && TryDecode(signature[3..], out var given)
                && CryptographicOperations.FixedTimeEquals(expected, given))
            {
                return true;
            }
        }

        return false;
    }

    private static bool TryDecode(string base64, out byte[] bytes)
    {
        bytes = new byte[base64.Length];
        if (Convert.TryFromBase64String(base64, bytes, out var written))
        {
            bytes = bytes[..written];
            return true;
        }

        return false;
    }
}

app.MapPost("/webhooks/meles", async (HttpRequest request) =>
{
    using var buffer = new MemoryStream();
    await request.Body.CopyToAsync(buffer);
    var headers = request.Headers.ToDictionary(header => header.Key.ToLowerInvariant(), header => header.Value.ToString());
    if (!MelesWebhooks.Verify(buffer.ToArray(), headers, secret, DateTimeOffset.UtcNow))
    {
        return Results.BadRequest();
    }

    // Deduplicate on headers["webhook-id"], then parse the JSON.
    return Results.NoContent();
});