Verify webhooks

Partner Console posts affiliate lifecycle events (joins, referrals, payout transitions) to your endpoints as JSON with an HMAC signature.

Each delivery carries:

Content-Type: application/json
X-Timestamp: <unix seconds>
X-Mantle-Webhook-Topic: <event type>
X-Mantle-Hmac-SHA256: <signature>

The header names intentionally match Mantle’s scheme, so verification code written for their webhooks keeps working unchanged.

Verifying

The signature is HMAC-SHA256 over "<timestamp>.<json body>" using your endpoint’s signing secret:

import hashlib, hmac, json

def verify(secret: str, timestamp: str, payload: dict, signature: str) -> bool:
    message = f"{timestamp}.{json.dumps(payload)}"
    expected = hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Reject anything whose signature fails or whose timestamp is older than a few minutes (replay protection). Deliveries are best-effort with a short timeout; design your handler to be idempotent on the event payload.