Email webhooks you can verify, retry and replay.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(request, rawBody, secret) {
    const id = request.headers["outstamp-id"];
    const timestamp = request.headers["outstamp-timestamp"];
    const header = request.headers["outstamp-signature"] ?? "";

    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

    const expected = createHmac("sha256", secret)
        .update(`${id}.${timestamp}.${rawBody}`)
        .digest("hex");

    return header.split(",")
        .map((part) => part.trim().replace(/^v1=/, ""))
        .some((candidate) => candidate.length === expected.length &&
            timingSafeEqual(Buffer.from(candidate, "hex"), Buffer.from(expected, "hex")));
}