Plaid webhook signature verification.
Supports both HMAC-SHA256 (legacy) and JWT-based (current) verification. Uses constant-time comparison to prevent timing attacks.
Summary
Functions
Verifies a Plaid webhook request.
Types
@type verification_error() ::
:missing_header
| :invalid_signature
| :expired_webhook
| :body_hash_mismatch
| :key_fetch_failed
| :unsupported_format
| :missing_iat_claim
| :missing_body_hash_claim
| :invalid_jwt_header
| :invalid_jwt_format
| :invalid_jwt_claims
@type verification_result() :: :ok | {:error, verification_error()}
Functions
@spec verify(binary(), String.t() | nil, PlaidEx.Config.t()) :: verification_result()
Verifies a Plaid webhook request.
raw_body— raw request bytes (before JSON parsing)header_value— value of thePlaid-Verificationheaderconfig— PlaidEx config containing the webhook_secret