docs: def verify_telesign_callback_signature(api_key, signature, json_str):
      """
      Verify that a callback was made by TeleSign and was not sent by a malicious client by verifying the signature.
  
      :param api_key: the TeleSign API api_key associated with your account.
      :param signature: the TeleSign Authorization header value supplied in the callback, as a string.
      :param json_str: the POST body text, that is, the JSON string sent by TeleSign describing the transaction status.
      """
      your_signature = b64encode(HMAC(b64decode(api_key), json_str.encode("utf-8"), sha256).digest()).decode("utf-8")
  
      if len(signature) != len(your_signature):
          return False
  
      # avoid timing attack with constant time equality check
      signatures_equal = True
      for x, y in zip(signature, your_signature):
          if not x == y:
              signatures_equal = False
  
      return signatures_equal