verification.py

@functions_framework.http
def main(request):
  if "X-Hub-Signature-256" not in request.headers:
    return "nok", 401

  signature = hmac.new(
    WHATSAPP_API_APP_SECRET.encode("utf-8"),
    msg=request.get_data(as_text=True).encode("utf-8"),
    digestmod=hashlib.sha256
  ).hexdigest()

  if f"sha256={signature}" != request.headers["X-Hub-Signature-256"]:
    return "nok", 401