def verify_telesign_callback_signature(api_key, signature, json_str):
your_signature = b64encode(HMAC(b64decode(api_key), json_str.encode("<STR_LIT:utf-8>"), sha256).digest()).decode("<STR_LIT:utf-8>")<EOL>if len(signature) != len(your_signature):<EOL><INDENT>return False<EOL><DEDENT>signatures_equal = True<EOL>for x, y in zip(signature, your_signature):<EOL><INDENT>if not x == y:<EOL><INDENT>signatures_equal = False<EOL><DEDENT><DEDENT>return signatures_equal<EOL>
Verify that a callback was made by TeleSign and was not sent by a malicious client by verifying the signature.

:param api_key: the TeleSign API api_key associated with your account.
:param signature: the TeleSign Authorization header value supplied in the callback, as a string.
:param json_str: the POST body text, that is, the JSON string sent by TeleSign describing the transaction status.