Function isSecretTokenValid

isSecretTokenValid(
received: string | string[] | undefined,
expected: string,
): boolean
Compares the received X-Telegram-Bot-Api-Secret-Token header against the configured secret using a constant-time comparison, so that response timing cannot leak how many leading characters matched.
Parameters
- received: string | string[] | undefined
  The raw header value as read from the incoming request.
- expected: string
  The secret token configured via webhook.
Returns boolean
true if received matches expected.