Verify a Sume avatar video webhook in Go with hmac.Equal

The short answer

Use hmac.New(sha256.New, secret), write <timestamp>. and then the raw body, and compare the hex result prefixed with sume-v1= using hmac.Equal against every comma-separated entry in the signature header. The crypto/hmac package (read 2026-10-04) says Equal compares MACs without leaking timing information. Return true only if one entry matches, and refuse an empty secret outright.

The Go verifier

Read the body with io.ReadAll(r.Body) in your handler before anything else touches it, then pass the bytes straight in. The function is a library file, so drop it in its own package and call it from an http.HandlerFunc.

package sumewebhook

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"strings"
	"time"
)

func Verify(secret, ts, header string, body []byte) bool {
	t, err := strconv.ParseInt(ts, 10, 64)
	if secret == "" || err != nil || time.Since(time.Unix(t, 0)).Abs() > 300*time.Second {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(ts + "."))
	mac.Write(body)
	want := []byte("sume-v1=" + hex.EncodeToString(mac.Sum(nil)))
	ok := false
	for _, entry := range strings.Split(header, ",") {
		if hmac.Equal([]byte(strings.TrimSpace(entry)), want) {
			ok = true
		}
	}
	return ok
}

What Sume sends

Sume signs the raw JSON body of every terminal job event. An avatar talking video submitted with mode: "webhook" and a public HTTPS webhook_url ends in one of three events, and your endpoint must verify the signature before it trusts the payload. The contract from the webhook docs:

Why this Go code is shaped this way

The package documentation states that receivers should use Equal to compare MACs to avoid timing side-channels, so the code never uses == or bytes.Equal on signatures. time.Since(...).Abs() handles a timestamp in the future as well as the past, which is the symmetric 300 second window the docs describe.

Operating it

Verify against the raw bytes you received, never a parsed and re-serialized object, because any change in spacing breaks the HMAC. Return a 2xx only after you have stored the event durably, and use job_id as the idempotency key, since a delivery can arrive more than once. If your endpoint was down, POST /v1/jobs/{job_id}/webhook/redeliver (scope jobs:write) re-sends the real terminal event with a fresh timestamp and signature, and POST /v1/webhooks/test-deliveries sends a signed dummy webhook.test payload to try your route first. Keep polling the job status as a fallback, because ten refused attempts end automatic delivery.

The code refuses an empty secret and a stale or non-numeric timestamp, checks every sume-v1= entry in the header so a rotation never rejects a good delivery, and does not stop at the first match. A Standard avatar clip costs $0.184 per second, so a rejected webhook is not a rejected video: the render is already paid for and fetchable from the job result. For the same check in other languages, see the Node and Python versions, and the queue limits by plan if you submit many clips at once.