import { type IncomingHttpHeaders } from 'http';
/**
 * The header Metriport uses to deliver the webhook signature.
 * https://docs.metriport.com/medical-api/getting-started/webhooks#authentication
 */
export declare const METRIPORT_SIGNATURE_HEADER = "x-metriport-signature";
/**
 * Extracts the signature from the request headers, normalising the
 * `string | string[] | undefined` type that `IncomingHttpHeaders` allows.
 */
export declare const getSignatureFromHeaders: (headers: IncomingHttpHeaders) => string | undefined;
/**
 * Verifies a Metriport webhook request.
 *
 * Metriport signs each request with an HMAC-SHA256 of the raw request body
 * using the webhook key, delivered in the `x-metriport-signature` header. The
 * hash must be computed over the raw body (never the re-serialized payload),
 * which is why this takes the `rawBody` buffer.
 * https://docs.metriport.com/medical-api/getting-started/webhooks#authentication
 *
 * @returns `true` if the request is authorized: either no webhook key is
 * configured (verification disabled) or the signature is present and valid.
 * `false` when a key is configured but the signature is missing or invalid.
 */
export declare const isWebhookRequestAuthorized: ({ webhookKey, rawBody, headers, }: {
    webhookKey: string | undefined;
    rawBody: Buffer;
    headers: IncomingHttpHeaders;
}) => boolean;
