Verify Klarna Webhook Signatures

const crypto = require('crypto');

// Look up the signing key by the Klarna-Signing-Key-Id header.
function isValidKlarnaWebhook(rawBody, signature, signingKey) {
  const expected = crypto
    .createHmac('sha256', signingKey)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(signature));
}

import hashlib, hmac

def is_valid_klarna_webhook(raw_body: bytes, signature: str,
                            signing_key: str) -> bool:
    expected = hmac.new(signing_key.encode(), raw_body,
                        hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)