curl -X POST \
  "https://api.podero.com/api/partners/v2.0/org/{org_id}/notifications/webhooks" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-endpoint.example.com/podero/notifications",
    "topics": ["device.action_required", "device.information"]
  }'

import requests

resp = requests.post(
    f"https://api.podero.com/api/partners/v2.0/org/{org_id}/notifications/webhooks",
    headers={"Authorization": f"Bearer {token}"},
    json={
        "url": "https://your-endpoint.example.com/podero/notifications",
        "topics": ["device.action_required", "device.information"],
    },
)
webhook = resp.json()
signing_secret = webhook["signing_secret"]  # store this now

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300

def verify(secret: str, raw_body: bytes, header: str | None) -> bool:
    if not header:
        return False
    fields = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    try:
        timestamp = int(fields["t"])
        provided = fields["v1"]
    except (KeyError, ValueError):
        return False

    if abs(time.time() - timestamp) > TOLERANCE_SECONDS:
        return False

    signed = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, provided)

const crypto = require('crypto');

const TOLERANCE_SECONDS = 300;

function verify(secret, rawBody, header) {
  if (!header) return false;
  const fields = Object.fromEntries(
    header.split(',').filter(p => p.includes('=')).map(p => p.split('=', 2)),
  );
  const timestamp = parseInt(fields.t, 10);
  if (Number.isNaN(timestamp)) return false;

  if (Math.abs(Date.now() / 1000 - timestamp) > TOLERANCE_SECONDS) return false;

  const signed = Buffer.concat([Buffer.from(`${timestamp}.`), rawBody]);
  const expected = crypto.createHmac('sha256', secret).update(signed).digest('hex');

  const a = Buffer.from(expected);
  const b = Buffer.from(fields.v1 || '', 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}