...
Retrieve the raw body of the request
Extract the value from the
x-signatureheaderCompute the HMAC of the raw body using the SHA-256 hash function and the Signing Secret
Compare the computed HMAC with the one provided in the
x-signatureheader
| Info |
|---|
The following is an example using ASP.NET |
| Code Block |
|---|
// Get the signature from the X-Signature header.
var signature = Request.Headers["X-Signature"].FirstOrDefault();
if (string.IsNullOrEmpty(signature))
{
return BadRequest();
}
// Get the raw payload.
string jsonPayload;
await using (Request.Body)
{
using var reader = new StreamReader(Request.Body);
jsonPayload = await reader.ReadToEndAsync();
}
// Calculate the signature.
var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(_setupOptions.SigningSecret));
var calculatedSignature = Convert.ToHexString(hmac.ComputeHash(Encoding.UTF8.GetBytes(jsonPayload)));
if (signature != calculatedSignature)
{
return BadRequest();
} |
Expected Webhook Events for Common Scenarios
...