import requests

response = requests.post(
    "https://api.saturday.fit/v1/webhooks",
    headers={"Authorization": "Bearer sk_test_abc123def456"},
    json={
        "url": "https://your-app.com/webhooks/saturday",
        "events": [
            "prescription.calculated",
            "athlete.updated",
            "athlete.created",
        ],
    },
)

webhook = response.json()
# Save webhook["secret"] — you need it to verify signatures
print(f"Webhook secret: {webhook['secret']}")

const response = await fetch("https://api.saturday.fit/v1/webhooks", {
  method: "POST",
  headers: {
    Authorization: "Bearer sk_test_abc123def456",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://your-app.com/webhooks/saturday",
    events: ["prescription.calculated", "athlete.updated", "athlete.created"],
  }),
});

const webhook = await response.json();
// Save webhook.secret — you need it to verify signatures
console.log(`Webhook secret: ${webhook.secret}`);

import hashlib
import hmac
import time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_webhook_secret_here"

@app.route("/webhooks/saturday", methods=["POST"])
def handle_webhook():
    # 1. Extract signature header
    signature_header = request.headers.get("X-Saturday-Signature")
    if not signature_header:
        abort(400, "Missing signature header")

    # 2. Parse timestamp and signature
    parts = signature_header.split(",")
    timestamp = None
    signature = None
    for part in parts:
        key, value = part.split("=", 1)
        if key == "t":
            timestamp = value
        elif key == "v1":
            signature = value

    if not timestamp or not signature:
        abort(400, "Invalid signature format")

    # 3. Reject stale timestamps (5-minute replay window)
    if abs(time.time() - int(timestamp)) > 300:
        abort(400, "Timestamp too old — possible replay attack")

    # 4. Compute expected signature
    raw_body = request.get_data(as_text=True)
    signed_payload = f"{timestamp}.{raw_body}"
    expected = hmac.new(
        WEBHOOK_SECRET.encode("utf-8"),
        signed_payload.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

    # 5. Constant-time comparison
    if not hmac.compare_digest(expected, signature):
        abort(400, "Invalid signature")

    # 6. Process the event
    event = request.json
    print(f"Received event: {event['type']}")

    # Always return 200 quickly — process async if needed
    return "", 200

import crypto from "crypto";
import express from "express";

const app = express();
const WEBHOOK_SECRET = "whsec_your_webhook_secret_here";

app.post(
  "/webhooks/saturday",
  express.raw({ type: "application/json" }),
  (req, res) => {
    // 1. Extract signature header
    const signatureHeader = req.headers["x-saturday-signature"] as string;
    if (!signatureHeader) {
      return res.status(400).send("Missing signature header");
    }

    // 2. Parse timestamp and signature
    const parts = Object.fromEntries(
      signatureHeader.split(",").map((p) => p.split("=", 2) as [string, string])
    );
    const timestamp = parts["t"];
    const signature = parts["v1"];

    if (!timestamp || !signature) {
      return res.status(400).send("Invalid signature format");
    }

    // 3. Reject stale timestamps (5-minute replay window)
    if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) {
      return res.status(400).send("Timestamp too old");
    }

    // 4. Compute expected signature
    const rawBody = req.body.toString("utf-8");
    const signedPayload = `${timestamp}.${rawBody}`;
    const expected = crypto
      .createHmac("sha256", WEBHOOK_SECRET)
      .update(signedPayload)
      .digest("hex");

    // 5. Constant-time comparison
    if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
      return res.status(400).send("Invalid signature");
    }

    // 6. Process the event
    const event = JSON.parse(rawBody);
    console.log(`Received event: ${event.type}`);

    // Always return 200 quickly
    res.status(200).send();
  }
);