SIGNED EVENT DELIVERY

Verify HMAC signatures

Receive owner-scoped HomeAutoPro events at a validated public HTTPS endpoint.

Verify the exact raw body

import hashlib, hmac
expected = "sha256=" + hmac.new(WEBHOOK_SECRET.encode(), raw_body, hashlib.sha256).hexdigest()
if not hmac.compare_digest(expected, signature):
    raise ValueError("invalid signature")

import crypto from "node:crypto";
const expected = "sha256=" + crypto.createHmac("sha256", WEBHOOK_SECRET).update(rawBody).digest("hex");
if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) throw new Error("invalid signature");