Called when subscription changed or renewed

We recommend that you verify all calls from us to your webhook endpoints. We sign each request with the Hook-HMAC header. The value is a HMAC digest derived from the body of the request and a secret key only known by the API and you. We also supply the type of event in the Hook-Event header.

Here is a sample implementation in Python. This process is very similar to the one Shopify uses so more information can possibly be gleaned from their documentation.

import base64
import hmac
import hashlib

WEBHOOK_SECRET = "Your webhook secret".encode()
WEBHOOK_DIGEST_TYPE = 'sha512'

def verify(hmac_header, digest_method, secret, message):
   digestmod = getattr(hashlib, digest_method)
   signed = base64.b64encode(
       hmac.new(secret, message, digestmod).digest(),
   ).strip()
   return hmac.compare_digest(signed, hmac_header)

# your view function
def handle_webhook(request):
   # The signature
   digest = request.META.get('HTTP_HOOK_HMAC').encode()
   # The name of the webhook event
   event = request.META.get('HTTP_HOOK_EVENT').encode()

   body = request.body
   if verify(digest, WEBHOOK_DIGEST_TYPE, WEBHOOK_SECRET, body):
       payload = json.loads(body)
       # ... the rest of your code here```