Verify Requests

export const POST = async (req: Request) => {
  const webhookSignature = req.headers.get('Agentset-Signature');
  if (!webhookSignature) {
    return new Response('No signature provided.', { status: 401 });
  }

  // Copy this from the webhook details page
  const secret = process.env.AGENTSET_WEBHOOK_SECRET;
  if (!secret) {
    return new Response('No secret provided.', { status: 401 });
  }

  // Make sure to get the raw body from the request
  const rawBody = await req.text();

  const computedSignature = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  if (webhookSignature !== computedSignature) {
    return new Response('Invalid signature', { status: 400 });
  }

  // Handle the webhook event
  // ...
};

import hmac
import hashlib

def webhook():
    # Get the signature from the header
    webhook_signature = request.headers.get('Agentset-Signature')
    if not webhook_signature:
        abort(401, 'No signature provided.')

    # Copy this from the webhook details page
    secret = os.environ.get('AGENTSET_WEBHOOK_SECRET')
    if not secret:
        abort(401, 'No secret provided.')

    # Get the raw body of the request
    raw_body = request.data

    # Calculate the HMAC
    computed_signature = hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()

    if webhook_signature != computed_signature:
        abort(400, 'Invalid signature')

    # Handle the webhook event
    # ...

    return 'OK', 200

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io/ioutil"
	"net/http"
	"os"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	// Get the signature from the header
	webhookSignature := r.Header.Get("Agentset-Signature")
	if webhookSignature == "" {
		http.Error(w, "No signature provided.", http.StatusUnauthorized)
		return
	}

	// Copy this from the webhook details page
	secret := os.Getenv("AGENTSET_WEBHOOK_SECRET")
	if secret == "" {
		http.Error(w, "No secret provided.", http.StatusUnauthorized)
		return
	}

	// Read the raw body
	body, err := ioutil.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "Error reading request body", http.StatusInternalServerError)
		return
	}

	// Calculate the HMAC
	h := hmac.New(sha256.New, []byte(secret))
	h.Write(body)
	computedSignature := hex.EncodeToString(h.Sum(nil))

	if webhookSignature != computedSignature {
		http.Error(w, "Invalid signature", http.StatusBadRequest)
		return
	}

	// Handle the webhook event
	// ...

	w.WriteHeader(http.StatusOK)
	w.Write([]byte("OK"))
}