> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attio.com/llms.txt
> Use this file to discover all available pages before exploring further.

# timingSafeEqual

> Compare secrets without revealing where they differ

```js theme={"system"}
import {timingSafeEqual} from "attio/server"
```

Compares two buffers in time that depends only on their length, so the comparison does not reveal
where they differ. Use it to check secrets, such as webhook signatures, instead of `===`.

It has the same signature as Node's
[`crypto.timingSafeEqual`](https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b).

## Example: Verifying a webhook signature

```ts src/app/webhooks/signed-event.webhook.ts theme={"system"}
import {timingSafeEqual} from "attio/server"

export default async function webhookHandler(request: Request) {
  const body = await request.text()
  const signature = request.headers.get("x-signature") ?? ""

  const key = await crypto.subtle.importKey(
    "raw",
    new TextEncoder().encode(process.env.WEBHOOK_SECRET),
    {name: "HMAC", hash: "SHA-256"},
    false,
    ["sign"],
  )
  const expected = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body))
  const received = Uint8Array.from(atob(signature), (char) => char.charCodeAt(0))

  if (received.byteLength !== expected.byteLength || !timingSafeEqual(received, expected)) {
    return new Response("Invalid signature", {status: 401})
  }

  return new Response(null, {status: 200})
}
```

## API

### `timingSafeEqual(a, b): boolean`

Returns `true` when both buffers hold the same bytes.

#### Parameters

**a** `ArrayBuffer | ArrayBufferView` *required*

The first buffer.

**b** `ArrayBuffer | ArrayBufferView` *required*

The second buffer. Must have the same byte length as `a`.

#### Errors

* Throws a `RangeError` when `a` and `b` have different byte lengths.
* Throws a `TypeError` when either input is not an `ArrayBuffer` or a view, such as a string.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.