NBN® that shows you what the network actually sees.

import hmac
import hashlib
import time

def verify_crazytel_nbn_webhook(raw_body: bytes, sig_header: str, secret: str, tolerance_sec: int = 300) -> bool:
    parts = [item.strip().split("=", 1) for item in sig_header.split(",") if "=" in item]
    timestamps = [v for k, v in parts if k == "t"]
    signatures = [v for k, v in parts if k == "v1"]
    if not timestamps or not signatures:
        return False

    ts = int(timestamps[0])
    if abs(int(time.time()) - ts) > tolerance_sec:
        return False

    signed_payload = f"{ts}.".encode("utf-8") + raw_body
    expected = hmac.new(secret.encode("utf-8"), signed_payload, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, candidate) for candidate in signatures)

import crypto from 'node:crypto';

export function verifyCrazytelNbnWebhook(rawBodyBuffer, sigHeader, secret, toleranceSec = 300) {
  const parts = String(sigHeader || '').split(',').map((p) => p.trim().split('='));
  const ts = Number(parts.find(([k]) => k === 't')?.[1]);
  const v1Sigs = parts.filter(([k]) => k === 'v1').map(([, v]) => v);
  if (!Number.isFinite(ts) || v1Sigs.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - ts) > toleranceSec) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${ts}.`)
    .update(rawBodyBuffer)
    .digest('hex');

  const expectedBuf = Buffer.from(expected, 'hex');
  return v1Sigs.some((sig) => {
    const candidateBuf = Buffer.from(sig, 'hex');
    return candidateBuf.length === expectedBuf.length && crypto.timingSafeEqual(expectedBuf, candidateBuf);
  });
}

The signature is an HMAC-SHA256 over <timestamp>.<raw body>. Secrets are shown once. When you rotate one, pick a dual-signing grace window (0, 1, 6, 12 or 24 hours) and we sign with both secrets, so you can roll keys with no downtime.