Webhooks

const crypto = require('crypto');

function verifySignature(rawBody, signature, kid, jwks) {
  // Find key by kid
  const key = jwks.keys.find(k => k.kid === kid);
  if (!key) throw new Error('Unknown key');
  
  // Decode public key from base64
  const publicKeyBytes = Buffer.from(key.x, 'base64');
  
  // Create Ed25519 public key
  const publicKey = crypto.createPublicKey({
    key: publicKeyBytes,
    format: 'raw',
    type: 'ed25519'
  });
  
  // Verify signature
  const signatureBytes = Buffer.from(signature, 'base64');
  return crypto.verify(null, rawBody, publicKey, signatureBytes);
}

import base64
from nacl.signing import VerifyKey

def verify_signature(raw_body, signature, kid, jwks):
    # Find key by kid
    key = next((k for k in jwks['keys'] if k['kid'] == kid), None)
    if not key:
        raise ValueError('Unknown key')
    
    # Decode public key from base64
    public_key_bytes = base64.b64decode(key['x'])
    verify_key = VerifyKey(public_key_bytes)
    
    # Verify signature
    signature_bytes = base64.b64decode(signature)
    verify_key.verify(raw_body, signature_bytes)
    return True

import (
    "crypto/ed25519"
    "encoding/base64"
)

func verifySignature(rawBody []byte, signature, kid string, jwks *JWKS) error {
    // Find key by kid
    var key *JWK
    for _, k := range jwks.Keys {
        if k.Kid == kid {
            key = &k
            break
        }
    }
    if key == nil {
        return fmt.Errorf("unknown key")
    }
    
    // Decode public key from base64
    publicKeyBytes, err := base64.StdEncoding.DecodeString(key.X)
    if err != nil {
        return err
    }
    
    // Verify signature
    signatureBytes, _ := base64.StdEncoding.DecodeString(signature)
    if !ed25519.Verify(publicKeyBytes, rawBody, signatureBytes) {
        return fmt.Errorf("invalid signature")
    }
    return nil
}