Struct WebhookSignature 

pub struct WebhookSignature;

Helper for constructing signature configurations.

Use in webhook attributes like:

#[forge::webhook(
    signature = WebhookSignature::hmac_sha256("X-Stripe-Signature", "STRIPE_SECRET"),
)]

Implementations

impl WebhookSignature

pub const fn hmac_sha256( header: &'static str, secret_env: &'static str, ) -> SignatureConfig

Create HMAC-SHA256 signature config.

Arguments

• header - The HTTP header containing the signature (e.g., “X-Hub-Signature-256”)
• secret_env - Environment variable containing the secret

pub const fn hmac_sha1( header: &'static str, secret_env: &'static str, ) -> SignatureConfig

Create HMAC-SHA1 signature config.

Arguments

• header - The HTTP header containing the signature
• secret_env - Environment variable containing the secret

pub const fn hmac_sha512( header: &'static str, secret_env: &'static str, ) -> SignatureConfig

Create HMAC-SHA512 signature config.

Arguments

• header - The HTTP header containing the signature
• secret_env - Environment variable containing the secret

pub const fn standard_webhooks(secret_env: &'static str) -> SignatureConfig

Create a Standard Webhooks signature config (https://www.standardwebhooks.com).

Used by Polar and other services that implement the Standard Webhooks spec. The signature header is always webhook-signature; no need to specify it.

The secret may have a whsec_ or polar_whs_ prefix — both are stripped and the remainder is base64-decoded to obtain the raw HMAC key.

Arguments

• secret_env - Environment variable containing the webhook secret

pub const fn stripe_webhooks(secret_env: &'static str) -> SignatureConfig

Create a Stripe webhook signature config.

Signs {timestamp}.{body} with HMAC-SHA256. The Stripe-Signature header carries both the timestamp (t=) and one or more signatures (v1=). Requests older than 5 minutes are rejected to guard against replay attacks.

Arguments

• secret_env - Environment variable containing the Stripe webhook signing secret

pub const fn shopify_webhooks(secret_env: &'static str) -> SignatureConfig

Create a Shopify webhook signature config.

HMAC-SHA256 over the raw body, base64-encoded. The signature arrives in the X-Shopify-Hmac-Sha256 header.

Arguments

• secret_env - Environment variable containing the Shopify webhook secret

pub const fn ed25519( header: &'static str, public_key_env: &'static str, ) -> SignatureConfig

Create an Ed25519 asymmetric signature config.

The service signs the request body with an Ed25519 private key and publishes the matching public key for you to verify with. The public_key_env variable should hold the base64-encoded 32-byte Ed25519 public key.

Arguments

• header - The HTTP header containing the base64-encoded signature
• public_key_env - Environment variable containing the base64-encoded public key