Outbound webhook format

{
  "id": "5d0c7f1e-9a51-4f3e-8c1b-2a7e6f0b9c34",
  "event": "content.published",
  "created_at": "2026-11-10T14:03:22.418Z",
  "business": {
    "id": "b7e2…",
    "site_url": "https://www.example.com"
  },
  "actor": {
    "kind": "user",
    "id": "willo:user:3f1c…"
  },
  "data": {
    "item_id": 412,
    "collection": "blog",
    "slug": "spring-opening-hours",
    "title": "Spring opening hours",
    "status": "published",
    "url": "https://www.example.com/blog/spring-opening-hours/",
    "visibility": "live",
    "published_at": "2026-11-10T14:03:21.907Z"
  }
}

import crypto from "node:crypto";

// rawBody: the request body exactly as received (a Buffer), before JSON parsing.
function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest("hex");
  const given = Buffer.from(parts.v1 ?? "", "hex");
  const want = Buffer.from(expected, "hex");
  return given.length === want.length && crypto.timingSafeEqual(given, want);
}

import hashlib, hmac, time

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected.encode(), parts.get("v1", "").encode())