import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.util.*;
public class WebhookHandler {

  private static final String MAC_SHA256_ALGO = "HmacSHA256";
  
  public boolean verifySignature(Map <String, Object> payload) {
    final String signature = payload.get("signature");
    final String computedSignature = generateSignature(payload);
    return signature.equals(computedSignature);
  }

  public String generateSignature(Map <String, Object> payload) {
    try {
      String secretKey = "ac7960e7995536f0177fd210f3b3937fc2d974a4"; // merchant will have this.
      SortedSet<String> keys = new TreeSet<String>(payload.keySet());
      for (String key : keys) {
        if ((key.length() > 3) && (key.substring(0, 3).equals("cf_"))) {
          data = data + key + ((String[])postData.get(key))[0];
        }
      }
      Mac mac = Mac.getInstance(MAC_SHA256_ALGO);
      SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getBytes(), MAC_SHA256_ALGO);
      mac.init(secretKeySpec);
      final byte[] encrypted = mac.doFinal(data.getBytes());
      return Base64.getEncoder().encodeToString(encrypted);
    }
    catch (Exception ex) {
      // handle
    }
  }
}

<?php

class WebhookHandler {

  public static function triggerHook ($data) {
    $signature = $data["signature"];
    $secretKey = "ac7960e7995536f0177fd210f3b3937fc2d974a4"; // merchant will have this.
    $computedSignature = static::generateSignature($data, $secretKey);
    return $signature == $computedSignature;
  }

  private static function generateSignature ($data, $clientSecret) {
  ksort($data); // Sort the $data array based on keys
  $signatureData = "";
  foreach ($data as $key => $value) {
    if (strlen($key) > 0 && substr($key, 0, 3) == "cf_") {
      $signatureData .= $key . $value;
    }
  }
  $hash_hmac = hash_hmac('sha256', $signatureData, $secretKey, true);
  
  $computedSignature = base64_encode($hash_hmac);
  return $computedSignature;
  } 

?>

import json
data=json.loads("""
{"cf_event":"SUBSCRIPTION_STATUS_CHANGE","cf_eventTime":"2023-01-13 13:57:50","cf_lastStatus":"INITIALIZED","cf_status":"BANK_APPROVAL_PENDING","cf_subReferenceId":108587
,"signature":"eFiNqQ8U/fJNrklKa100muagXZZvMH+a7ysFCfmE2+A="}""")

sign=data["signature"];
del(data["signature"])

cs="TEST307e06bddd583cc3f86edf02f410fa8a69653d7d" #PG
#cs="fc7a78ea906e3c9f93f14cfcc70f5928feb002f2" #Payout

from urllib import parse
import hmac
import hashlib
import base64

data = json.dumps(data, sort_keys=True)
print(data)

data=json.loads(data)

f = ""
for x in data:
    f=f+str(x)+str(data[x])
print(f)

data=f
val_str = str(data)

hash_val = hmac.new(cs.encode(), val_str.encode(), hashlib.sha256).digest()

gen_signature = base64.b64encode(hash_val)

gen_signature=str(gen_signature)
print(gen_signature)

sign="b'"+sign+"'"

print(sign)

if (sign==gen_signature):
    print("MATCHED")
else:
    print("MISMATCH")