Trust the signature, not the network.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, header, secret, tolerance = 300) {
  const parts = Object.fromEntries(
    header.split(',').map((part) => part.split('=', 2))
  );
  const timestamp = Number(parts.t);
  const signatures = header.split(',')
    .filter((part) => part.startsWith('v1='))
    .map((part) => part.slice(3));
  if (!Number.isFinite(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > tolerance) return false;
  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  return signatures.some((value) => {
    if (!/^[a-f0-9]{64}$/i.test(value)) return false;
    return timingSafeEqual(Buffer.from(value, 'hex'), Buffer.from(expected, 'hex'));
  });
}

import hashlib
import hmac
import time

def verify_webhook(raw_body: bytes, header: str, secret: str, tolerance=300):
    values = [part.split("=", 1) for part in header.split(",") if "=" in part]
    timestamp = next((value for key, value in values if key == "t"), None)
    signatures = [value for key, value in values if key == "v1"]
    if timestamp is None or abs(time.time() - int(timestamp)) > tolerance:
        return False
    signed = timestamp.encode() + b"." + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, signature) for signature in signatures)

<?php
function verifyWebhook(string $rawBody, string $header, string $secret, int $tolerance = 300): bool {
    $timestamp = null;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', $part, 2), 2, null);
        if ($key === 't') $timestamp = (int) $value;
        if ($key === 'v1' && $value !== null) $signatures[] = $value;
    }
    if (!$timestamp || abs(time() - $timestamp) > $tolerance) return false;
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) return true;
    }
    return false;
}

function Test-UptimeWebhookSignature {
  param([byte[]]$RawBody, [string]$Header, [string]$Secret, [int]$ToleranceSeconds = 300)
  $parts = $Header -split ','
  $timestamp = [long](($parts | Where-Object { $_ -like 't=*' }) -replace '^t=', '')
  if ([Math]::Abs([DateTimeOffset]::UtcNow.ToUnixTimeSeconds() - $timestamp) -gt $ToleranceSeconds) { return $false }
  $prefix = [Text.Encoding]::UTF8.GetBytes("$timestamp.")
  $signed = [byte[]]::new($prefix.Length + $RawBody.Length)
  [Array]::Copy($prefix, 0, $signed, 0, $prefix.Length)
  [Array]::Copy($RawBody, 0, $signed, $prefix.Length, $RawBody.Length)
  $hmac = [Security.Cryptography.HMACSHA256]::new([Text.Encoding]::UTF8.GetBytes($Secret))
  $expected = [Convert]::ToHexString($hmac.ComputeHash($signed)).ToLowerInvariant()
  return @($parts | Where-Object { $_ -match '^v1=[a-fA-F0-9]{64}$' } | ForEach-Object {
    [Security.Cryptography.CryptographicOperations]::FixedTimeEquals(
      [Text.Encoding]::ASCII.GetBytes($expected),
      [Text.Encoding]::ASCII.GetBytes(($_ -replace '^v1=', ''))
    )
  }) -contains $true
}