verify_webhook_signature (openwa/webhook.py)

Python helper that verifies OpenWA webhook signatures using HMAC SHA256.

# Source: https://github.com/rmyndharis/OpenWA | License: MIT | Copyright 2026 Yudhi Armyndharis and OpenWA Contributors
# Provided via justclaw.it.com; keep this notice with the code.
"""Webhook delivery signature check."""

from __future__ import annotations

import hashlib
import hmac
import re

_SIGNATURE = re.compile(r"sha256=([0-9a-fA-F]{64})")


def verify_webhook_signature(raw_body: bytes | str, signature: str | None, secret: str) -> bool:
    """Check a delivery's ``X-OpenWA-Signature`` header (``sha256=<hex HMAC-SHA256>``) against the
    webhook secret.

    Pass the raw request body exactly as received; a re-serialized parse can differ byte for byte
    and will not verify. Returns False (never raises) for a missing, malformed or non-matching
    signature and for an empty secr

... (truncated -- full source via MCP)