Docspring.Webhooks (docspring v4.3.0)
Checks webhook requests' X-DocSpring-Signature header (https://docspring.com/docs/webhooks/verifying-signatures/).
Summary
Functions
Checks a webhook request's X-DocSpring-Signature header. Returns true when one of its v1 signatures is the
HMAC-SHA256 of "{t}.{payload}" with the webhook's secret, and its timestamp t is at most :tolerance seconds from
:now. Returns false for anything else, including a missing or malformed header.
Functions
Checks a webhook request's X-DocSpring-Signature header. Returns true when one of its v1 signatures is the
HMAC-SHA256 of "{t}.{payload}" with the webhook's secret, and its timestamp t is at most :tolerance seconds from
:now. Returns false for anything else, including a missing or malformed header.
payload is the request body exactly as it was received (Plug: read it before Plug.Parsers parses it), not
parsed JSON.
Options
:tolerance- how many seconds old (or early) the timestamp can be. 5 minutes by default.:now- the current Unix time in seconds, for tests. The system clock by default.