Setup

import os
import json
import hmac
import hashlib
import time
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["OPENMAIL_WEBHOOK_SECRET"]

def verify_webhook(payload: bytes, timestamp: str, signature: str) -> bool:
    message = f"{timestamp}.{payload.decode()}".encode()
    expected = hmac.new(SECRET.encode(), message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route("/webhooks", methods=["POST"])
def webhook():
    payload = request.get_data()
    timestamp = request.headers.get("X-Timestamp", "")
    signature = request.headers.get("X-Signature", "")

    if not verify_webhook(payload, timestamp, signature):
        return "", 400

    if abs(time.time() - int(timestamp)) > 300:
        return "", 400

    data = json.loads(payload.decode())
    if data.get("event") == "message.received":
        # Route by inbox_id, process async
        inbox_id = data.get("inbox_id")
        message = data.get("message", {})
        # ... handle message
    return "", 200

if __name__ == "__main__":
    app.run(port=3000)

const express = require("express");
const crypto = require("crypto");

const app = express();
const SECRET = process.env.OPENMAIL_WEBHOOK_SECRET;

function verifyWebhook(payload, timestamp, signature) {
  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${timestamp}.${payload}`)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected, "hex")
  );
}

app.post("/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  const payload = req.body.toString();
  const timestamp = req.headers["x-timestamp"] || "";
  const signature = req.headers["x-signature"] || "";

  if (!verifyWebhook(payload, timestamp, signature)) {
    return res.status(400).send();
  }

  if (Math.abs(Date.now() / 1000 - parseInt(timestamp, 10)) > 300) {
    return res.status(400).send();
  }

  const data = JSON.parse(payload);
  if (data.event === "message.received") {
    const { inbox_id, message } = data;
    // ... handle message
  }
  res.status(200).send();
});

app.listen(3000);