Verifying Webhooks

import { createHmac } from "crypto";

routes.post("/webhook", (request) => {
    const body          = request.rawBody;
    const signatureTime = request.headers["X-Shopfront-Signature-Time"];
    const signature     = request.headers["X-Shopfront-Signature"];
    const webhookId     = request.body.webhookId;

    // Get the signing key for your webhook from somewhere, it's better to
    // cache or store this on your side instead of sending a request to
    // Shopfront each time you receive a webhook.
    const signingKey = getWebhookSigningKey(webhookId);

    const hmac = createHmac("sha256", signingKey);
    hmac.update(`${signatureTime}${body}`);

    const recreated = hmac.digest("hex");

    if(recreated === signature) {
        // Webhook is valid and from Shopfront
    } else {
        // Webhook is invalid. Reject the request.
    }
});

<?php

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;

Route::post("/webhook", function(ServerRequestInterface $request): ResponseInterface {
    $body          = (string)$request->getBody();
    $signatureTime = $request->getHeader("X-Shopfront-Signature-Time")[0];
    $signature     = $request->getHeader("X-Shopfront-Signature")[0];
    $webhookId     = $request->getParsedBody()->webhookId;

    // Get the signing key for your webhook from somewhere, it's better to
    // cache or store this on your side instead of sending a request to
    // Shopfront each time you receive a webhook.
    $signingKey = getWebhookSigningKey($webhookId);

    if(hash_hmac("sha256", $signatureTime . $body, $signingKey) === $signature) {
        // Webhook is valid and from Shopfront
    } else {
        // Webhook is invalid. Reject the request
    }
});