Webhooks

const crypto = require('crypto');
// Use the raw body bytes — not a re-serialised JSON object
app.post('/webhooks/transfi', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto.createHmac('sha256', process.env.TRANSFI_WEBHOOK_SECRET).update(req.body).digest('hex');
  const received = req.headers['x-transfi-hmac-hash'] || '';      // Node lower-cases header names
  const valid = expected.length === received.length &&
                crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
  if (!valid) return res.status(401).end();
  res.status(200).end();                                           // acknowledge first…
  process(JSON.parse(req.body));                                   // …then do the work
});

import hmac, hashlib, os
raw = request.get_data()                                           # raw bytes, not request.get_json()
expected = hmac.new(os.environ['TRANSFI_WEBHOOK_SECRET'].encode(), raw, hashlib.sha256).hexdigest()
received = request.headers.get('X-Transfi-Hmac-Hash', '')
if not hmac.compare_digest(expected, received):
    return '', 401

Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
byte[] digest = mac.doFinal(rawBodyBytes);                         // the exact bytes received
String expected = HexFormat.of().formatHex(digest);
boolean valid = MessageDigest.isEqual(expected.getBytes(StandardCharsets.UTF_8), received.getBytes(StandardCharsets.UTF_8));