Say plz from code.

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

/**
 * True when a PLZBRO webhook is genuine and fresh. Pass the raw body exactly
 * as it arrived: parsing and re-serializing it changes the bytes.
 */
export function verifyWebhook(secret, headers, rawBody) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatures = headers["webhook-signature"];
  if (!id || !timestamp || !signatures) return false;

  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!(age <= TOLERANCE_SECONDS)) return false;

  const key = Buffer.from(secret.slice("whsec_".length), "base64");
  const expected = createHmac("sha256", key).update(`${id}.${timestamp}.`).update(rawBody).digest();

  // The header may carry several signatures, space-separated; one v1 match is enough.
  return signatures.split(" ").some((entry) => {
    const [version, signature = ""] = entry.split(",");
    const given = Buffer.from(signature, "base64");
    return version === "v1" && given.length === expected.length && timingSafeEqual(given, expected);
  });
}

// Express: read the body raw, verify, then parse.
// app.post("/hooks/plzbro", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verifyWebhook(process.env.PLZBRO_WEBHOOK_SECRET, req.headers, req.body)) return res.sendStatus(400);
//   const event = JSON.parse(req.body);
//   res.sendStatus(204);
// });

import base64
import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300


def verify_webhook(secret: str, headers, raw_body: bytes) -> bool:
    """True when a PLZBRO webhook is genuine and fresh. Pass the raw body exactly as it arrived."""
    msg_id = headers.get("webhook-id")
    timestamp = headers.get("webhook-timestamp")
    signatures = headers.get("webhook-signature")
    if not (msg_id and timestamp and signatures):
        return False
    try:
        if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
            return False
    except ValueError:
        return False

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest())

    # The header may carry several signatures, space-separated; one v1 match is enough.
    return any(
        version == "v1" and hmac.compare_digest(signature.encode(), expected)
        for version, _, signature in (entry.partition(",") for entry in signatures.split(" "))
    )


# Flask: request.headers is case-insensitive and get_data() returns the raw bytes.
# ok = verify_webhook(os.environ["PLZBRO_WEBHOOK_SECRET"], request.headers, request.get_data())

import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "node:crypto";
import { existsSync, readFileSync, writeFileSync } from "node:fs";

const API = "https://plzbro.io/api";
const PLZ = "k3v9xq2m"; // the plz whose referrals rule names your key

// Once: make a key pair. The private key stays on your server; the public key goes on the plz as `attestor`.
if (!existsSync("attestor.pem")) {
  const { privateKey } = generateKeyPairSync("ed25519");
  writeFileSync("attestor.pem", privateKey.export({ type: "pkcs8", format: "pem" }), { mode: 0o600 });
}
const key = createPrivateKey(readFileSync("attestor.pem"));
console.log("attestor:", base58(Buffer.from(createPublicKey(key).export({ format: "jwk" }).x, "base64url")));

/** Report conversions, each with your own event id and the ref the person arrived with. */
export async function attest(events) {
  const body = JSON.stringify({ plz: PLZ, events });
  // Sign exactly the bytes you send: serializing again could change them.
  const signature = sign(null, Buffer.from(body), key).toString("base64");
  const response = await fetch(`${API}/v1/plz/${PLZ}/attestations`, {
    method: "POST",
    headers: { "content-type": "application/json", "plzbro-attestation-signature": signature },
    body,
  });
  if (!response.ok) throw new Error(`attestations: ${response.status} ${await response.text()}`);
  return response.json(); // { plzId, results: [{ id, outcome }], accepted }
}

function base58(bytes) {
  const alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
  let n = BigInt(`0x${bytes.toString("hex")}`);
  let out = "";
  for (; n > 0n; n /= 58n) out = alphabet[Number(n % 58n)] + out;
  for (const byte of bytes) {
    if (byte) break;
    out = `1${out}`;
  }
  return out;
}

// await attest([{ id: "signup-48213", type: "signup", ref: "usr_7m3k9x2q4w8e5r6t.3f9a1c0b7e", occurredAt: new Date().toISOString() }]);

import base64
import json
import os
import urllib.request

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

API = "https://plzbro.io/api"
PLZ = "k3v9xq2m"  # the plz whose referrals rule names your key

# Once: make a key pair. The private key stays on your server; the public key goes on the plz as attestor.
if not os.path.exists("attestor.pem"):
    pem = Ed25519PrivateKey.generate().private_bytes(
        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()
    )
    with open(os.open("attestor.pem", os.O_WRONLY | os.O_CREAT, 0o600), "wb") as file:
        file.write(pem)
with open("attestor.pem", "rb") as file:
    key = serialization.load_pem_private_key(file.read(), password=None)


def base58(data: bytes) -> str:
    alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
    n, out = int.from_bytes(data, "big"), ""
    while n:
        n, digit = divmod(n, 58)
        out = alphabet[digit] + out
    return "1" * (len(data) - len(data.lstrip(b""))) + out


print("attestor:", base58(key.public_key().public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw)))


def attest(events):
    """Report conversions, each with your own event id and the ref the person arrived with."""
    body = json.dumps({"plz": PLZ, "events": events}).encode()
    # Sign exactly the bytes you send.
    signature = base64.b64encode(key.sign(body)).decode()
    request = urllib.request.Request(
        f"{API}/v1/plz/{PLZ}/attestations",
        data=body,
        method="POST",
        headers={"content-type": "application/json", "plzbro-attestation-signature": signature},
    )
    with urllib.request.urlopen(request) as response:
        return json.load(response)  # {"plzId", "results": [{"id", "outcome"}], "accepted"}


# from datetime import datetime, timezone
# attest([{"id": "signup-48213", "type": "signup", "ref": "usr_7m3k9x2q4w8e5r6t.3f9a1c0b7e", "occurredAt": datetime.now(timezone.utc).isoformat()}])