Your own systems hear about your money the moment it moves

import hashlib, hmac, time

def verify(secret: str, body: bytes, header: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    stamp, given = parts["t"], parts["v1"]
    if abs(time.time() - int(stamp)) > 300:
        return False
    signed = f"{stamp}.".encode() + body
    want = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(given, want)

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(secret, body, header) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const stamp = Number(parts.t);
  if (Math.abs(Date.now() / 1000 - stamp) > 300) return false;
  const signed = Buffer.concat([Buffer.from(`${stamp}.`), body]);
  const want = createHmac("sha256", secret).update(signed).digest("hex");
  if (parts.v1.length !== want.length) return false;
  return timingSafeEqual(Buffer.from(parts.v1), Buffer.from(want));
}

body is the raw bytes of the request, not an object you serialised again: a JSON library that reorders keys or changes spacing changes the digest. The window is yours to choose; five minutes covers clock drift without covering a replay.