Syntropy.Webhooks.Signature (syntropy v0.2.0)

HMAC-SHA256 signing for outbound webhook deliveries.

Every delivery body is signed with the per-endpoint secret. Receivers verify by recomputing sha256=hex(hmac_sha256(secret, raw_body)) and comparing it to the x-syntropy-signature header with a constant-time comparison.

Summary

Functions

sign(body, secret)

Sign a raw request body with an endpoint secret.

valid?(signature_header, body, secret)

Verify a signature header against a raw body and secret in constant time.

Functions

sign(body, secret)

@spec sign(String.t(), String.t()) :: String.t()

Sign a raw request body with an endpoint secret.

Returns the full header value, e.g. "sha256=ab12...".

valid?(signature_header, body, secret)

@spec valid?(String.t(), String.t(), String.t()) :: boolean()

Verify a signature header against a raw body and secret in constant time.