Inbound Webhook

import crypto from 'crypto';

// `rawBody` is the exact string received (e.g. from express.raw()).
function verify(rawBody, signatureHeader, secret) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}

app.post('/minimo/webhook', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.header('X-Minimo-Signature');
  if (!sig || !verify(req.body.toString('utf8'), sig, process.env.MINIMO_WEBHOOK_SECRET)) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body.toString('utf8'));
  // ... hand `event` to your bot, respond 2xx quickly ...
  res.sendStatus(200);
});

import hmac, hashlib

def verify(raw_body: bytes, signature_header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

# Flask example
@app.post("/minimo/webhook")
def webhook():
    sig = request.headers.get("X-Minimo-Signature", "")
    if not verify(request.get_data(), sig, MINIMO_WEBHOOK_SECRET):
        return "", 401
    event = request.get_json()
    # ... hand event to your bot, respond 2xx quickly ...
    return "", 200