Verify a Sume Format webhook in Python with an empty-secret guard

Sume signs each terminal webhook with HMAC-SHA256 over <timestamp>.<raw_body>. The signature header looks like sume-v1=<hex>, the timestamp is Unix seconds in x-sume-webhook-timestamp, and you should reject anything outside a five-minute window. Verify against the raw bytes, not a re-serialized JSON object, and refuse to run at all if the secret is empty: an empty secret makes every signature trivially forgeable.

Verifier

import hashlib, hmac, time

def verify(secret: str, timestamp: str, signature: str, raw_body: bytes) -> bool:
    if not secret:
        raise ValueError("webhook secret is empty")
    try:
        ts = int(timestamp)
    except ValueError:
        return False
    if abs(time.time() - ts) > 300:
        return False
    msg = timestamp.encode() + b"." + raw_body
    expected = "sume-v1=" + hmac.new(secret.encode(), msg, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Headers and dedupe

Handle repeats

Deliveries retry, so dedupe on request_id or run_id before you act. Return a 2xx quickly and do the work after. The TypeScript SDK ships a verifyWebhook helper with the same rules; see SDK webhooks.