Verify WhatsApp Webhook Signatures

const crypto = require('crypto');

// express.raw() keeps the exact bytes Meta signed
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.META_APP_SECRET)
    .update(req.body)          // Buffer, not a re-stringified object
    .digest('hex');
  const received = req.get('x-hub-signature-256') || '';
  const ok = received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
  if (!ok) return res.sendStatus(401);

  res.sendStatus(200);         // ack fast, process async
  handle(JSON.parse(req.body));
});

import hmac, hashlib, os
from flask import request, abort

@app.post("/webhook")
def whatsapp_webhook():
    raw = request.get_data()  # raw bytes, before request.json
    expected = "sha256=" + hmac.new(
        os.environ["META_APP_SECRET"].encode(), raw, hashlib.sha256
    ).hexdigest()
    received = request.headers.get("X-Hub-Signature-256", "")
    if not hmac.compare_digest(expected, received):
        abort(401)
    return "", 200