CaptainHookSignature.Plug.HTTPSignature (captain_hook_signature v0.3.0) View Source

Verifies the request body in order to ensure that its signature is valid. This verification can avoid someone to send a request on behalf of our client.

So the client must send a header with the following structure:

t=timestamp-in-seconds,
v1=signature

Where the timestamp-in-seconds is the system time in seconds, and signature is the HMAC using the SHA256 algorithm of timestamp and the payload, signed by a shared secret with us.

This is based on what Stripe is doing: https://stripe.com/docs/webhooks/signatures