Webhooks

<?php
define('WEBHOOK_SECRET_KEY', 'my-secret-key');

function isFromHelpScout($data, $signature) {
	$calculated = base64_encode(hash_hmac('sha1', $data, WEBHOOK_SECRET_KEY, true));
	return $signature == $calculated;
}

$signature = $_SERVER['X-HELPSCOUT-SIGNATURE'];
$data = file_get_contents('php://input');
if (isFromHelpScout($data, $signature)) {
	// do something
}
?>

publicclassHelpScoutAuthorization

{

  privatestring _secret;

  publicHelpScoutAuthorization(string secret)

  {

    _secret = secret;

  }

  ///<summary>

  /// Use signature to validate this message is from HelpScout

  ///</summary>

  ///<param name="jsonRequestBody">The JSON body</param>

  ///<param name="signature">Typically from Request.Headers["X-HelpScout-Signature"]</param>

  publicbool IsFromHelpScout(string jsonRequestBody, string signature)

  {

    return (HashHmac(jsonRequestBody, _secret) == signature);

  }

  privatestring HashHmac(string message, string secret)

  {

    System.Text.Encoding encoding = System.Text.Encoding.UTF8;

    using(var hmac = new System.Security.Cryptography.HMACSHA1(encoding.GetBytes(secret)))

    {

      var messageByteArray = encoding.GetBytes(message);

      var hash = hmac.ComputeHash(messageByteArray);

      return System.Convert.ToBase64String(hash);

    }

  }

}

#!/usr/bin/ruby -rrubygems
#
require 'base64'
require 'hmac-sha1' # gem install ruby-hmac
require 'rack/utils' # gem install rack

WEBHOOK_SECRET_KEY = "your secret key"

# Returns true if the webhook request is verified to have come from Help Scout.
#
# data       String  The data posted by Help Scout to the webhook.
# signature  String  Value for the http-x-helpscout-signature header.
#
def is_from_help_scout(data, signature)
  hmac = HMAC::SHA1.new(WEBHOOK_SECRET_KEY)
  hmac.update(data)
  Rack::Utils.secure_compare(Base64.encode64("#{hmac.digest}").strip, signature.strip)
end

# Usage Example
signature = "+oNIxipGoqx4t2BmkBHbXKc6VHM="
data = '{"ticket":{"id":"1","number":"2"},"customer":{"id":"1","fname":"Jackie","lname":"Chan","email":"jackie.chan@somewhere.com","emails":["jackie.chan@somewhere.com"]}}'

puts "This request came from Help Scout:"
puts is_from_help_scout(data, signature)

#!/usr/bin/ruby -rrubygems

require 'openssl'
require 'base64'
require 'rack/utils'

WEBHOOK_SECRET_KEY = "your secret key"

def is_from_help_scout?(data, signature)
  return false if data.nil? || signature.nil?
  digest = OpenSSL::HMAC.digest('sha1', WEBHOOK_SECRET_KEY, data)
  Rack::Utils.secure_compare(Base64.encode64("#{digest}").strip, signature.strip)
end

data = '{"ticket":{"id":"1","number":"2"},"customer":{"id":"1","fname":"Jackie","lname":"Chan","email":"jackie.chan@somewhere.com","emails":["jackie.chan@somewhere.com"]}}'
signature = request.headers['X-Helpscout-Signature'] # or use signature = 'I1KlvGppYqvFTJgJ9jezdQMDiyI=' which is an actual signature of the data above

puts "This request came from Help Scout:"
puts is_from_help_scout?(data, signature)

/*jshint node: true */
'use strict';

var crypto = require('crypto'),
config = require('../lib/config').config;

module.exports = function(secret) {
    return function(req, res, next) {
        req.isHelpScout = false;

        var hsSignature = req.header('X-HelpScout-Signature');
        if (hsSignature) {
            req.hsHasher = crypto.createHmac('sha1', secret);
            req.on('data', function (chunk) {
                req.hsHasher.update(chunk);
            });
            req.on('end', function() {
                var hash = req.hsHasher.digest('base64');
                req.isHelpScout = hash === hsSignature ? true : false;
            });
        }
        next();
    };
};