Webhooks

import { verifyWebhookSignature, parseWebhookEvent } from "@phala/cloud/webhook";

// Option 1: Verify signature manually
const isValid = verifyWebhookSignature({
  secret: "whsec_...",
  timestamp: req.headers["x-webhook-timestamp"],
  body: rawBody,
  signature: req.headers["x-webhook-signature"],
});

// Option 2: Parse and verify in one step (throws on failure)
try {
  const event = parseWebhookEvent({
    headers: req.headers,
    body: rawBody,
    secret: "whsec_...",
  });
  console.log(event.event, event.data);
} catch (err) {
  // Invalid signature or expired timestamp
  res.status(401).send("Invalid signature");
}

from phala_cloud import verify_webhook_signature, parse_webhook_event

# Option 1: Verify signature manually
is_valid = verify_webhook_signature(
    secret="whsec_...",
    timestamp=request.headers["X-Webhook-Timestamp"],
    body=request.body.decode(),
    signature=request.headers["X-Webhook-Signature"],
)

# Option 2: Parse and verify in one step (raises on failure)
try:
    event = parse_webhook_event(
        headers=dict(request.headers),
        body=request.body.decode(),
        secret="whsec_...",
    )
    print(event.event, event.data)
except ValueError:
    # Invalid signature or expired timestamp
    return Response(status_code=401)

import phala "github.com/Phala-Network/phala-cloud-sdk-go"

// Option 1: Verify signature
ok := phala.VerifyWebhookSignature(secret, timestamp, string(body), signature)

// Option 2: Parse and verify (returns error on failure)
event, err := phala.ParseWebhookEvent(r.Header, body, secret)
if err != nil {
    http.Error(w, "Invalid signature", http.StatusUnauthorized)
    return
}
fmt.Println(event.Event, string(event.Data))