How to verify crypto payment webhook signatures

X-Gateway-Signature: <hex HMAC-SHA256>
X-Gateway-Timestamp: <unix ms>

Signature = HMAC-SHA256(webhookSecret, timestamp + rawBody)

function verifyWebhook(rawBody, signature, timestamp, webhookSecret, toleranceMs = 5 * 60 * 1000) {
  if (Math.abs(Date.now() - timestamp) > toleranceMs) return false;
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(timestamp + rawBody)
    .digest('hex');
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(signature, 'hex');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post('/webhooks/payaries', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.header('X-Gateway-Signature');
  const timestamp = Number(req.header('X-Gateway-Timestamp'));
  const rawBody = req.body.toString('utf8');   // the RAW body — before any JSON parsing

  if (!verifyWebhook(rawBody, signature, timestamp, process.env.WEBHOOK_SECRET)) return res.sendStatus(401);

  const event = JSON.parse(rawBody);
  res.sendStatus(200);                          // acknowledge first, do the slow work after
  queue.add(event);                             // dedupe on event.idempotencyKey
});