A WhatsApp API that behaves the way you would design it.

import crypto from 'node:crypto';

export function verify(req, secret) {
  const sig = req.headers['x-signature'];        // 'v1,sha256=<hex>'
  const ts  = req.headers['x-timestamp'];

  // Reject anything outside a 5-minute replay window.
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = 'v1,sha256=' + crypto
    .createHmac('sha256', secret)
    .update(ts + '.' + req.rawBody)              // RAW body, not re-serialized
    .digest('hex');

  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}