VALIDATE QUICKBOOKS SIGNATURE HEADER FOR WEBHOOK PYTHON

validate.py

import base64
import hmac
import hashlib

def validate_signature_header(verifier_token, request_body, signature):
    # per quickbooks documentation
    # 1st step:
    #     hash the notification payload (request_body) with HMAC_SHA256_ALGORITHM 
    #     using <verifier token> as the key
    hmac_hex_digest = hmac.new(
        verifier_token, 
        request_body, 
        hashlib.sha256
    )
    # 2nd step:
    #     convert the intuit-signature header from base-64 to base-16
    decoded_hex_signature = base64.b64decode(
        signature
    ).encode('hex')
    # 3rd step
    # compare values from step 1 and 2 
    return hmac_hex_digest == decoded_hex_signature

I think the original code was written for python2. It did not work for me as well since I was using python3. Here is the code that worked for me:

import base64
import hmac
import hashlib

def validate_signature_header(verifier_token, request_body, signature):

hmac_hex_digest = hmac.new(
    verifier_token,    # token from quickbooks in bytes
    request_body,    # request_body = request.data
    hashlib.sha256
).hexdigest()

decoded_hex_signature = base64.b64decode(
    signature   # request.headers.get('intuit-signature')
).hex()

return hmac_hex_digest == decoded_hex_signature