Overview

// Server-side, webhook API key
import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const webhookApiKey = "wk_test_123";
const app = express();

app.post(
  "/webhooks/moonpay",
  // The HMAC covers these raw bytes. A parsed body does not.
  express.raw({ type: "application/json" }),
  (req, res) => {
    const header = req.get("Moonpay-Signature-V2");
    if (!header) {
      res.status(400).end();
      return;
    }

    const timestamp = header
      .split(",")
      .find((part) => part.startsWith("t="))
      ?.slice(2);
    const signature = header
      .split(",")
      .find((part) => part.startsWith("s="))
      ?.slice(2);
    if (!timestamp || !signature) {
      res.status(400).end();
      return;
    }

    const expected = createHmac("sha256", webhookApiKey)
      .update(`${timestamp}.${req.body.toString("utf8")}`)
      .digest("hex");
    const received = Buffer.from(signature);
    const computed = Buffer.from(expected);

    if (
      received.length !== computed.length ||
      !timingSafeEqual(received, computed)
    ) {
      res.status(400).end();
      return;
    }

    // A response after 5 seconds is a failed delivery.
    res.status(200).end();
  },
);