upsec-webhook 1.0.0

UpSec Webhook signature verification SDK for Python

upsec-webhook

Official Python SDK for verifying UpSec webhook signatures.

Installation

pip install upsec-webhook

Quick Start

from upsec import verify_signature

is_valid = verify_signature(
    payload=request.get_data(),
    secret=os.environ["WEBHOOK_SECRET"],
    signature=request.headers.get("X-Hub-Signature-256", ""),
)

Flask Decorator

from upsec.middleware import flask_webhook

@app.route("/webhook", methods=["POST"])
@flask_webhook(secret=os.environ["WEBHOOK_SECRET"])
def handle_webhook():
    # Signature verified automatically
    return {"ok": True}

API

verify_signature(payload, secret, signature, algorithm="sha256")

Returns True if the HMAC signature is valid. Uses constant-time comparison.

sign_payload(payload, secret, algorithm="sha256")

Returns a signed header string like sha256=<hex>. Useful for testing.

flask_webhook(secret, header, algorithm)

Flask decorator that auto-rejects invalid signatures with 401.