// Node.js + Express (save as .mjs, like the other Node examples)
import express from 'express';
import crypto from 'node:crypto';
const app = express();
const SECRET = process.env.READY_WEBHOOK_SECRET; // whsec_...

function isFromReady(rawBody, header) {
  const expected = 'sha256=' + crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex');
  const got = Buffer.from(String(header || ''));
  const want = Buffer.from(expected);
  return got.length === want.length && crypto.timingSafeEqual(got, want);
}

// express.raw keeps the exact bytes Ready signed; do not use express.json() on this route
app.post('/ready-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  if (!isFromReady(req.body, req.get('X-Signature'))) return res.sendStatus(401);
  let event, timestamp, data;
  try {
    ({ event, timestamp, data } = JSON.parse(req.body));
  } catch {
    return res.sendStatus(401);
  }
  // replay check: the signed timestamp must be within 5 minutes
  const sent = typeof timestamp === 'string' ? Date.parse(timestamp) : NaN;
  if (!Number.isFinite(sent) || Math.abs(Date.now() - sent) > 5 * 60 * 1000) return res.sendStatus(401);
  res.sendStatus(200);            // answer within 5 seconds
  setImmediate(() => console.log('OK', event, timestamp, JSON.stringify(data)));
});
app.listen(4789);

# Python (standard library only)
import hmac, hashlib, json, os
from datetime import datetime, timezone

SECRET = os.environ["READY_WEBHOOK_SECRET"].encode()  # whsec_...

def is_from_ready(raw_body: bytes, header: str) -> bool:
    expected = "sha256=" + hmac.new(SECRET, raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, header or ""):
        return False
    # replay check: the signed timestamp must be within 5 minutes
    try:
        timestamp = json.loads(raw_body)["timestamp"]
        sent = datetime.fromisoformat(timestamp.replace("Z", "+00:00"))
        if sent.tzinfo is None:
            return False
    except (ValueError, TypeError, KeyError, AttributeError):
        return False
    return abs((datetime.now(timezone.utc) - sent).total_seconds()) <= 300

# Flask: is_from_ready(request.get_data(), request.headers.get("X-Signature"))
# Django: is_from_ready(request.body, request.headers.get("X-Signature"))