Webhook Verification

{
  "event": "<event name>",
  "data": { /* event-specific payload */ },
  "timestamp": 1732718962
}

const crypto = require('crypto');

function verifyOnboardWebhook(rawBody, signatureHeader, timestampHeader, webhookSecret) {
  const signaturePayload = `t=${timestampHeader}&${rawBody}`;
  const expectedSignature = crypto
    .createHmac('sha256', webhookSecret)
    .update(signaturePayload)
    .digest('hex');

  return expectedSignature === signatureHeader;
}