Verify DocuSign Webhook Signatures

const crypto = require('crypto');

// payload must be the RAW request body bytes DocuSign sent.
function isValidDocuSignWebhook(payload, signature, hmacKey) {
  const expected = crypto
    .createHmac('sha256', hmacKey)
    .update(payload)
    .digest('base64');
  return crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(signature));
}

const ok = isValidDocuSignWebhook(
  rawBody,
  req.headers['x-docusign-signature-1'],
  process.env.DOCUSIGN_HMAC_KEY);

import base64, hashlib, hmac

def is_valid_docusign_webhook(payload: bytes, signature: str,
                              hmac_key: str) -> bool:
    digest = hmac.new(hmac_key.encode(), payload,
                      hashlib.sha256).digest()
    expected = base64.b64encode(digest).decode()
    return hmac.compare_digest(expected, signature)