Crate webhooksmith_actix 

Actix-web integration for webhooksmith.

Provides VerifiedWebhook and TypedWebhook<T> extractors that verify incoming webhook signatures (HMAC-SHA256) and reject forged, stale, or oversized requests.

Setup

Register the signing secret via WebhookSecret app data, then use VerifiedWebhook or TypedWebhook<T> as handler parameters:

use actix_web::{web, App, HttpServer, HttpResponse, Responder};
use webhooksmith_actix::{WebhookSecret, VerifiedWebhook, TypedWebhook};
use serde::Deserialize;

#[derive(Deserialize)]
struct OrderCreated { order_id: u64 }

async fn handle_raw(webhook: VerifiedWebhook) -> impl Responder {
    tracing::info!(event_type = %webhook.event_type, event_id = ?webhook.event_id, "received");
    HttpResponse::Ok().finish()
}

async fn handle_typed(webhook: TypedWebhook<OrderCreated>) -> impl Responder {
    tracing::info!(order_id = %webhook.payload.order_id, "order created");
    HttpResponse::Ok().finish()
}

HttpServer::new(|| {
    App::new()
        .app_data(WebhookSecret::new("your-signing-secret"))
        .route("/webhooks", web::post().to(handle_raw))
        .route("/orders", web::post().to(handle_typed))
})
.bind("0.0.0.0:8080")?
.run()
.await

Rejection behaviour

Condition	Status	Body
Missing x-hooksmith-signature	401	{"error":"missing signature"}
Missing x-hooksmith-timestamp	400	{"error":"missing timestamp"}
Invalid timestamp (not an integer)	400	{"error":"invalid timestamp"}
Stale timestamp (> 300 s skew)	401	{"error":"stale timestamp"}
Signature mismatch	401	{"error":"invalid signature"}
Body > 1 MB	413	{"error":"payload too large"}
Body is not valid JSON	422	{"error":"body must be JSON"}

Structs

TypedWebhook

Actix-web extractor that verifies the signature AND deserializes the JSON body into T.

VerifiedWebhook

Actix-web extractor that verifies the incoming webhook signature.

WebhookPayload

Verified webhook metadata and body, produced by the extractors.

WebhookSecret

App data holding the webhook signing secret.

Enums

WebhookError