Webhooks

<?php
  $payload = file_get_contents('php://input');
  $secret = 'WEBHOOK_SECRET'; // replace with your webhook secret, you can find it in your security settings on the sellix dashboard.
  $header_signature = $_SERVER['HTTP_X_SELLIX_SIGNATURE']; // get our signature header
  $signature = hash_hmac('sha512', $payload, $secret);

  if (hash_equals($signature, $header_signature)) {
    // handle valid webhook
  } else {
    // invalid webhook
  }
?>

const crypto = require('crypto');
const secret = 'WEBHOOK_SECRET'; // replace with your webhook secret, you can find it in your security settings on the sellix dashboard.
const headerSignature = req.headers['x-sellix-unescaped-signature'];
const payload = req.body;

const signature = crypto
  .createHmac('sha512', secret)
  .update(payload)
  .digest('hex');

if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(headerSignature, 'utf-8'))) {
  // handle valid webhook
} else {
  // invalid webhook
}

import hashlib
import hmac
import sys

payload = sys.stdin.buffer.read()
secret = b'WEBHOOK_SECRET' # replace with your webhook secret, you can find it in your security settings on the sellix dashboard.
header_signature = bytes.fromhex(sys.stdin.headers['X-Sellix-Signature']) # get our signature header
# depending on your server configuration, you might need to use the X-Sellix-Unescaped-Signature header instead
signature = hmac.new(secret, payload, hashlib.sha512).hexdigest()

if hmac.compare_digest(signature, header_signature):
  # handle valid webhook
else:
  # invalid webhook