HTTP Delivery

import { createHmac, timingSafeEqual } from 'node:crypto';

function verifySafeFetchSignature(rawBody: string, signatureHeader: string, apiKey: string): boolean {
  const expected = `sha256=${createHmac('sha256', apiKey).update(rawBody).digest('hex')}`;
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader || '');
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

import hmac
import hashlib

def verify_safefetch_signature(raw_body: bytes, signature_header: str, api_key: str) -> bool:
    expected = "sha256=" + hmac.new(api_key.encode("utf-8"), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header or "")