Verify signatures

# Extract components from X-RevKeen-Signature header
TIMESTAMP=$(echo "$SIGHDR" | grep -oE 't=[0-9]+' | cut -d= -f2)
SIGNATURE=$(echo "$SIGHDR" | grep -oE 'v1=[a-f0-9]+' | cut -d= -f2)

# Compute expected
EXPECTED=$(printf '%s.%s' "$TIMESTAMP" "$RAW_BODY" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

# Constant-time compare (bash has no native one — use a proper lib in prod)
[ "$EXPECTED" = "$SIGNATURE" ] || exit 1

import { RevKeen } from "@revkeen/sdk";

const client = new RevKeen({ apiKey: process.env.REVKEEN_API_KEY! });

// In your webhook handler (Next.js App Router, Hono, Express, etc.)
const rawBody = await request.text(); // Must be the raw string, not JSON.parse'd
const signature = request.headers.get("x-revkeen-signature");
const secret = process.env.REVKEEN_WEBHOOK_SECRET!;

try {
  const event = client.webhooks.verify(rawBody, signature!, secret);
  // event.type, event.data.object are now trusted
} catch (err) {
  return new Response("invalid signature", { status: 400 });
}

import (
  "io"
  "net/http"
  revkeen "github.com/RevKeen/sdk-go"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    sig := r.Header.Get("X-RevKeen-Signature")

    event, err := revkeen.Webhooks.Verify(body, sig, os.Getenv("REVKEEN_WEBHOOK_SECRET"))
    if err != nil {
        http.Error(w, "invalid signature", http.StatusBadRequest)
        return
    }

    // event.Type, event.Data.Object are now trusted
}

use RevKeen\Webhooks\WebhookVerifier;

$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_REVKEEN_SIGNATURE'] ?? '';
$secret = getenv('REVKEEN_WEBHOOK_SECRET');

try {
    $event = WebhookVerifier::verify($rawBody, $signature, $secret);
    // $event->type, $event->data->object are now trusted
} catch (\RevKeen\Exception\SignatureException $e) {
    http_response_code(400);
    exit('invalid signature');
}