A console built for the people who integrate

import hmac, hashlib, time, os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["OTPROUTE_WEBHOOK_SECRET"]

def verified(header: str, body: bytes) -> bool:
    p = dict(x.split("=", 1) for x in header.split(","))
    if abs(time.time() - int(p["t"])) > 300:
        return False
    mac = hmac.new(SECRET.encode(), p["t"].encode() + b"." + body,
                   hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, p.get("v1", ""))

@app.post("/hooks/otproute")
def hook():
    if not verified(request.headers.get("X-OTPRoute-Signature", ""), request.get_data()):
        abort(401)
    evt = request.get_json()
    if evt["type"] == "activation.sms_received":
        handle_code(evt["data"]["id"], evt["data"]["code"])
    return "", 204

import express from "express";
import crypto from "node:crypto";

const app = express();
const SECRET = process.env.OTPROUTE_WEBHOOK_SECRET;

function verified(header = "", raw) {
  const p = Object.fromEntries(header.split(",").map((x) => x.split("=")));
  if (!p.t || Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false;
  const mac = crypto.createHmac("sha256", SECRET)
    .update(`${p.t}.`).update(raw).digest("hex");
  return !!p.v1 && mac.length === p.v1.length &&
    crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(p.v1));
}

app.post("/hooks/otproute", express.raw({ type: "application/json" }), (req, res) => {
  if (!verified(req.get("X-OTPRoute-Signature"), req.body)) return res.sendStatus(401);
  const evt = JSON.parse(req.body);
  if (evt.type === "activation.sms_received") handleCode(evt.data.id, evt.data.code);
  res.sendStatus(204);
});