CaptainHookClient.Plugs.HTTPSignature (captain_hook_client v0.1.0) View Source
Verifies the request body in order to ensure that its signature is valid. This verification can avoid someone to send a request on behalf of our client.
So the client must send a header with the following structure:
t=timestamp-in-seconds,
v1=signature
Where the timestamp-in-seconds
is the system time in seconds, and signature
is the HMAC using the SHA256 algorithm of timestamp and the payload, signed by
a shared secret with us.
This is based on what Stripe is doing: https://stripe.com/docs/webhooks/signatures