Quickstart

import hmac
import hashlib
import base64

def handle_crc(crc_token, webhook_signing_secret):
    """
    Respond to an X CRC check.

    Args:
        crc_token: The crc_token query parameter from the GET request
        webhook_signing_secret: Your app's OAuth 2.0 client secret
            (or OAuth 1.0 consumer secret for legacy integrations)

    Returns:
        dict with the response_token
    """
    sha256_hash = hmac.new(
        webhook_signing_secret.encode('utf-8'),
        crc_token.encode('utf-8'),
        hashlib.sha256
    ).digest()

    return {
        "response_token": "sha256=" + base64.b64encode(sha256_hash).decode('utf-8')
    }

const crypto = require('crypto');

// OAuth 2.0 client secret (recommended). Set to your OAuth 1.0 consumer
// secret instead to keep an existing OAuth 1.0 integration working.
function handleCrc(crcToken, webhookSigningSecret) {
  const hmac = crypto
    .createHmac('sha256', webhookSigningSecret)
    .update(crcToken)
    .digest('base64');

  return {
    response_token: `sha256=${hmac}`
  };
}

import os
import hmac
import hashlib
import base64
from flask import Flask, request, jsonify

app = Flask(__name__)

# Recommended: the app's OAuth 2.0 client secret.
OAUTH2_CLIENT_SECRET = os.environ["OAUTH2_CLIENT_SECRET"]

# Optional: the app's OAuth 1.0 consumer secret (API Secret Key). Only set
# this while migrating an existing OAuth 1.0 integration.
OAUTH1_CONSUMER_SECRET = os.environ.get("OAUTH1_CONSUMER_SECRET")


def _sign(secret: str, message: bytes) -> str:
    digest = hmac.new(secret.encode("utf-8"), message, hashlib.sha256).digest()
    return "sha256=" + base64.b64encode(digest).decode("utf-8")


@app.route("/webhook", methods=["GET", "POST"])
def webhook():
    if request.method == "GET":
        # CRC check — respond with HMAC of crc_token using the OAuth 2.0
        # client secret.
        crc_token = request.args.get("crc_token")
        if not crc_token:
            return "Missing crc_token", 400
        return jsonify({"response_token": _sign(OAUTH2_CLIENT_SECRET, crc_token.encode("utf-8"))}), 200

    # POST — verify signature over the raw request body.
    raw_body = request.get_data()  # bytes

    oauth2_signature = request.headers.get("X-Twitter-Webhooks-Signature-OAuth2")
    if oauth2_signature is not None:
        expected = _sign(OAUTH2_CLIENT_SECRET, raw_body)
        if not hmac.compare_digest(expected, oauth2_signature):
            return "Invalid signature", 401
    else:
        # Legacy fallback for OAuth 1.0-only apps during migration.
        legacy_signature = request.headers.get("X-Twitter-Webhooks-Signature")
        if legacy_signature is None or OAUTH1_CONSUMER_SECRET is None:
            return "Missing signature", 401
        expected = _sign(OAUTH1_CONSUMER_SECRET, raw_body)
        if not hmac.compare_digest(expected, legacy_signature):
            return "Invalid signature", 401

    event = request.get_json(silent=True)
    print("Received event:", event)
    return "", 200

import hmac
import hashlib
import base64


def _sign(secret: str, payload: bytes) -> str:
    digest = hmac.new(secret.encode("utf-8"), payload, hashlib.sha256).digest()
    return "sha256=" + base64.b64encode(digest).decode("utf-8")


def verify_signature(
    payload: bytes,
    headers,
    oauth2_client_secret: str,
    oauth1_consumer_secret: str | None = None,
) -> bool:
    """
    Verify that a webhook POST request actually came from X.

    Args:
        payload: The raw request body (bytes).
        headers: A mapping of request headers.
        oauth2_client_secret: The app's OAuth 2.0 client secret (recommended).
        oauth1_consumer_secret: The app's OAuth 1.0 consumer secret. Only pass
            this when migrating from OAuth 1.0.

    Returns:
        True if the signature is valid.
    """
    oauth2_signature = headers.get("X-Twitter-Webhooks-Signature-OAuth2")
    if oauth2_signature is not None:
        expected = _sign(oauth2_client_secret, payload)
        return hmac.compare_digest(expected, oauth2_signature)

    legacy_signature = headers.get("X-Twitter-Webhooks-Signature")
    if legacy_signature is not None and oauth1_consumer_secret is not None:
        expected = _sign(oauth1_consumer_secret, payload)
        return hmac.compare_digest(expected, legacy_signature)

    return False

{
  "data": [
    {
      "created_at": "2025-01-15T12:00:00.000Z",
      "id": "1234567890",
      "url": "https://yourdomain.com/webhooks/twitter",
      "valid": true
    }
  ],
  "meta": {
    "result_count": 1
  }
}