Module webhook 

Webhook signature verification primitives: HMAC over the EXACT request bytes (pair with the RawBody extractor — re-serialized JSON never verifies). Comparisons are constant-time via hmac’s verify_slice.

Functions

sign_sha1_base64

Base64 HMAC-SHA1 of message — Twilio’s X-Twilio-Signature scheme (the URL with sorted POST params appended). SHA-1 is what Twilio specifies; HMAC-SHA1 remains secure as a MAC even though SHA-1 is broken for collision resistance.

sign_sha256_hex

Hex HMAC-SHA256 of message — the scheme Stripe (v1=), GitHub (sha256=), and most modern providers use.

verify_sha1_base64

Verifies a base64 HMAC-SHA1 signature in constant time. Malformed base64 simply fails verification.

verify_sha256_hex

Verifies a hex HMAC-SHA256 signature in constant time. Case-insensitive hex; malformed hex simply fails verification.