Webhook HMAC signing

#!/usr/bin/env bash
set -euo pipefail

URL="${WEBHOOK_URL:?}"
SECRET="${SIGNING_SECRET:?}"
BODY='{"event":"order.created","order_id":"ord_8f3c21","amount":"42.50"}'

TS="$(date +%s)"
# macOS: use openssl; Linux: openssl or sha256hmac
SIG="v1=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')"

curl -sS -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "X-Planasonix-Timestamp: $TS" \
  -H "X-Planasonix-Signature: $SIG" \
  --data-binary "$BODY"

import hashlib
import hmac
import json
import os
import time
import urllib.request

url = os.environ["WEBHOOK_URL"]
secret = os.environ["SIGNING_SECRET"].encode("utf-8")  # raw UTF-8 of the secret string
body_obj = {"event": "order.created", "order_id": "ord_8f3c21", "amount": "42.50"}
# Stable bytes: dump once, sign that buffer, send the same buffer
body = json.dumps(body_obj, separators=(",", ":")).encode("utf-8")

ts = str(int(time.time()))
signed = f"{ts}.".encode("utf-8") + body
digest = hmac.new(secret, signed, hashlib.sha256).hexdigest()
signature = f"v1={digest}"

req = urllib.request.Request(
    url,
    data=body,
    method="POST",
    headers={
        "Content-Type": "application/json",
        "X-Planasonix-Timestamp": ts,
        "X-Planasonix-Signature": signature,
    },
)
with urllib.request.urlopen(req) as resp:
    print(resp.status, resp.read().decode())

import crypto from "node:crypto";
import process from "node:process";

const url = process.env.WEBHOOK_URL;
const secret = process.env.SIGNING_SECRET; // UTF-8 string as shown in the UI
const bodyObj = { event: "order.created", order_id: "ord_8f3c21", amount: "42.50" };
const body = Buffer.from(JSON.stringify(bodyObj), "utf8");

const ts = Math.floor(Date.now() / 1000).toString();
const signed = Buffer.concat([Buffer.from(`${ts}.`, "utf8"), body]);
const digest = crypto.createHmac("sha256", secret).update(signed).digest("hex");
const signature = `v1=${digest}`;

const res = await fetch(url, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Planasonix-Timestamp": ts,
    "X-Planasonix-Signature": signature,
  },
  body,
});
console.log(res.status, await res.text());