Webhooks & signatures

const crypto = require('crypto');
const express = require('express');

function verifyAkdV2(secret, header, rawBody, toleranceSec = 300) {
  if (!header) return false;
  let t = null;
  const sigs = [];
  for (const part of header.split(',')) {
    const i = part.indexOf('=');
    if (i < 0) continue;
    const k = part.slice(0, i).trim();
    const v = part.slice(i + 1).trim();
    if (k === 't') t = v;
    else if (k === 'v1') sigs.push(v);
  }
  if (!t || !/^\d+$/.test(t) || Math.abs(Date.now() / 1000 - Number(t)) > toleranceSec) return false;
  const want = Buffer.from(crypto.createHmac('sha256', secret).update(`${t}.`).update(rawBody).digest('hex'));
  return sigs.some((s) => {
    const got = Buffer.from(s);
    return got.length === want.length && crypto.timingSafeEqual(got, want);
  });
}

const app = express();
app.post('/webhooks/akd', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyAkdV2(process.env.AKD_WEBHOOK_SECRET, req.get('X-AKD-Signature-V2'), req.body)) {
    return res.status(401).end();
  }
  const event = JSON.parse(req.body.toString('utf8'));
  // Deduplikasi dengan req.get('X-AKD-Event-ID'), lalu proses event.event / event.data.
  res.status(204).end();
});

<?php
function akd_verify_v2(string $secret, string $header, string $rawBody, int $tolerance = 300): bool
{
    $t = null;
    $sigs = [];
    foreach (explode(',', $header) as $part) {
        $kv = explode('=', trim($part), 2);
        if (count($kv) !== 2) {
            continue;
        }
        if ($kv[0] === 't') {
            $t = $kv[1];
        } elseif ($kv[0] === 'v1') {
            $sigs[] = $kv[1];
        }
    }
    if ($t === null || !ctype_digit($t) || abs(time() - (int) $t) > $tolerance) {
        return false;
    }
    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    foreach ($sigs as $sig) {
        if (hash_equals($expected, $sig)) {
            return true;
        }
    }
    return false;
}

$rawBody = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_AKD_SIGNATURE_V2'] ?? '';
if (!akd_verify_v2(getenv('AKD_WEBHOOK_SECRET'), $header, $rawBody)) {
    http_response_code(401);
    exit;
}
$event = json_decode($rawBody, true);
$eventId = $_SERVER['HTTP_X_AKD_EVENT_ID'] ?? '';
// Deduplikasi dengan $eventId, lalu proses $event['event'] / $event['data'].
http_response_code(204);

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"strings"
	"time"
)

func VerifyAKDV2(secret, header string, body []byte, now time.Time) bool {
	var t string
	var sigs []string
	for _, part := range strings.Split(header, ",") {
		k, v, ok := strings.Cut(strings.TrimSpace(part), "=")
		if !ok {
			continue
		}
		switch k {
		case "t":
			t = v
		case "v1":
			sigs = append(sigs, v)
		}
	}
	ts, err := strconv.ParseInt(t, 10, 64)
	if err != nil {
		return false
	}
	if d := now.Unix() - ts; d > 300 || d < -300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(t + "."))
	mac.Write(body)
	want := []byte(hex.EncodeToString(mac.Sum(nil)))
	for _, s := range sigs {
		if hmac.Equal([]byte(s), want) {
			return true
		}
	}
	return false
}

// Di handler: body, _ := io.ReadAll(r.Body); VerifyAKDV2(secret, r.Header.Get("X-AKD-Signature-V2"), body, time.Now())

const want = crypto.createHmac('sha256', legacyKey).update(rawBody).digest('hex');
const ok = sig.length === want.length && crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(want));

$ok = hash_equals(hash_hmac('sha256', $rawBody, $legacyKey), $_SERVER['HTTP_X_AKD_SIGNATURE'] ?? '');

mac := hmac.New(sha256.New, []byte(legacyKey))
mac.Write(body)
ok := hmac.Equal([]byte(r.Header.Get("X-AKD-Signature")), []byte(hex.EncodeToString(mac.Sum(nil))))