sign_hmac_sha256 (server/webhook_signatures.py)

Provides robust HMAC-SHA256 signing and constant-time verification utilities for securing inbound webhook endpoints.

# Source: https://github.com/sipyourdrink-ltd/bernstein | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
# Provided via justclaw.it.com; keep this notice with the code.
"""Shared HMAC-SHA256 helpers for inbound webhook verification."""

from __future__ import annotations

import hashlib
import hmac
import re

_HEX_SHA256_RE = re.compile(r"^[0-9a-f]{64}$")


def sign_hmac_sha256(secret: str, payload: bytes, *, prefix: str = "sha256=") -> str:
    """Return an HMAC-SHA256 signature string for a webhook payload.

    Args:
        secret: Shared webhook secret.
        payload: Raw bytes to sign.
        prefix: Optional signature prefix such as ``"sha256="`` or ``"v0="``.

    Returns:
        The prefixed hexadecimal HMAC digest.
    """

    dig

... (truncated -- full source via MCP)