Webhook Notifications for OTP Verification | OTP.ID

const crypto = require('crypto');

function verifyWebhook(req, webhookSecret) {
  const timestamp = req.headers['x-otpid-timestamp'];
  const signature = req.headers['x-otpid-signature'];
  const rawBody = req.body; // raw string, not parsed JSON

  const message = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(message)
    .digest('hex');

  // Use timingSafeEqual to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

import hmac
import hashlib

def verify_webhook(timestamp: str, signature: str, raw_body: str, webhook_secret: str) -> bool:
    message = f"{timestamp}.{raw_body}"
    expected = hmac.new(
        webhook_secret.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

const express = require('express');
const crypto = require('crypto');

const app = express();

// Use raw body middleware so you receive the original bytes
app.use('/webhook/otp', express.raw({ type: 'application/json' }));

app.post('/webhook/otp', (req, res) => {
  const timestamp = req.headers['x-otpid-timestamp'];
  const signature = req.headers['x-otpid-signature'];
  const rawBody = req.body.toString('utf8');

  // 1. Verify the signature immediately — reject anything that doesn't match
  const message = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac('sha256', process.env.OTPID_WEBHOOK_SECRET)
    .update(message)
    .digest('hex');

  const isValid = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature ?? '')
  );

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  // 2. Acknowledge immediately — do not wait for your business logic
  res.status(200).send('OK');

  // 3. Process the event asynchronously
  const event = JSON.parse(rawBody);
  setImmediate(() => handleOtpVerified(event));
});

async function handleOtpVerified(event) {
  if (event.event !== 'otp.verified') return;
  // e.g. mark the session as authenticated, grant access, send a welcome message
  console.log(`Transaction ${event.otp_id} verified at ${event.verified_at}`);
}

import hmac
import hashlib
import asyncio
from fastapi import FastAPI, Request, Response

app = FastAPI()
WEBHOOK_SECRET = "your_webhook_secret_here"

@app.post("/webhook/otp")
async def receive_webhook(request: Request):
    timestamp = request.headers.get("x-otpid-timestamp", "")
    signature = request.headers.get("x-otpid-signature", "")
    raw_body = (await request.body()).decode("utf-8")

    # 1. Verify the signature immediately
    message = f"{timestamp}.{raw_body}"
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        return Response(content="Invalid signature", status_code=401)

    # 2. Acknowledge immediately
    import json
    event = json.loads(raw_body)

    # 3. Schedule async processing (fire-and-forget)
    asyncio.create_task(handle_otp_verified(event))

    return Response(content="OK", status_code=200)

async def handle_otp_verified(event: dict):
    if event.get("event") != "otp.verified":
        return
    print(f"Transaction {event['otp_id']} verified at {event['verified_at']}")