Verifying a webhook's signature

const crypto = require('crypto')

function verifyClinikEHRSignature({ id, timestamp, rawBody, header, secret }) {
  const keyBytes = Buffer.from(secret.replace(/^whsec_/, ''), 'hex')
  const signedContent = `${id}.${timestamp}.${rawBody}`
  const expected = 'v1,' + crypto.createHmac('sha256', keyBytes).update(signedContent).digest('base64')

  const candidates = header.split(' ')
  return candidates.some((candidate) => {
    if (candidate.length !== expected.length) return false
    return crypto.timingSafeEqual(Buffer.from(candidate), Buffer.from(expected))
  })
}

// Worked example — every value below is made up, not a real secret or delivery.
const ok = verifyClinikEHRSignature({
  id: 'evt_test',
  timestamp: '1700000000',
  rawBody: '{"hello":"world"}',
  header: 'v1,g0/GKvJ9tW+X8y5c7ZzKz6f1234567890abcdefgh+ijklmn=',
  secret: 'whsec_6ec4b1a92f6cf9e6cdf5f4f6c6a9c2e29f6a6c9d2e6f5c4b',
})

import hashlib
import hmac
import base64

def verify_clinikehr_signature(id, timestamp, raw_body, header, secret):
    key_bytes = bytes.fromhex(secret.removeprefix("whsec_"))
    signed_content = f"{id}.{timestamp}.{raw_body}".encode()
    digest = hmac.new(key_bytes, signed_content, hashlib.sha256).digest()
    expected = "v1," + base64.b64encode(digest).decode()

    candidates = header.split(" ")
    return any(hmac.compare_digest(candidate, expected) for candidate in candidates)

# Worked example — every value below is made up, not a real secret or delivery.
ok = verify_clinikehr_signature(
    id="evt_test",
    timestamp="1700000000",
    raw_body='{"hello":"world"}',
    header="v1,g0/GKvJ9tW+X8y5c7ZzKz6f1234567890abcdefgh+ijklmn=",
    secret="whsec_6ec4b1a92f6cf9e6cdf5f4f6c6a9c2e29f6a6c9d2e6f5c4b",
)