Module webhooks 

Verifying what Fizzy posts to a webhook. Every delivery carries an X-Webhook-Signature header: the hex HMAC-SHA256 of the raw body under the webhook’s secret.

use fizzy_sdk::webhooks::{SIGNATURE_HEADER, compute_signature, verify_signature};

let secret = "whsec_test";
let body = br#"{"event":"card.created"}"#;
let signature = compute_signature(body, secret);
assert!(verify_signature(body, &signature, secret));
assert!(!verify_signature(b"tampered", &signature, secret));
assert_eq!(SIGNATURE_HEADER, "X-Webhook-Signature");

Constants

SIGNATURE_HEADER

The header a delivery’s signature arrives in.

Functions

compute_signature

The hex HMAC-SHA256 of payload under secret, as Fizzy signs a delivery.

verify_signature

Whether signature is the HMAC-SHA256 of payload under secret, compared in constant time. An empty secret or signature never verifies.