Authentication

const { createHmac } = require('crypto')
const config = require('../config')


// This middleware validates the request body against the X-Ivy-Signature header.
// If the signature is invalid, an error is thrown.
// If the signature is valid, the next middleware is called.
function validateRequest(req, res, next) {
  const secret = config.IVY_WEBHOOK_SIGNING_SECRET
  const data = req.body
  const expectedSignature = sign(data, secret)

  const signature = req.get('X-Ivy-Signature')

  if (signature !== expectedSignature) throw new Error('Invalid signature!')

  next()
}

// Parameter "data" is the request/response body.
// The response is the X-Ivy-Signature.
function sign(data, secret) {
  const hmac = createHmac('sha256', secret)
  hmac.update(JSON.stringify(data))
  return hmac.digest('hex')
}

import hmac
import hashlib
import json
import os

def sign(data):
    return hmac.new(
        os.environ['IVY_WEBHOOK_SIGNING_SECRET'].encode('utf-8'),
        json.dumps(data).encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

<?php
// Assuming you have a similar config file in PHP
require_once('../config.php');

/*
  This function validates the request body against the X-Ivy-Signature header.
  If the signature is invalid, false is returned.
*/
function isValidRequest(RequestInterface $request)
{
    $hash = hash_hmac(
        'sha256',
        $request->getContent(),
        $this->config->getWebhookSecret()
    );

    if ($request->getHeaders('x-ivy-signature')->getFieldValue() === $hash) {
        return true;
    }

    return false;
}