WebhookVerifier class final

Verifies the signatures of webhook and route deliveries.

AhaSend signs deliveries with the Standard Webhooks scheme: the webhook-signature header holds v1,<base64 HMAC-SHA256> of {webhook-id}.{webhook-timestamp}.{body}. Unlike some Standard Webhooks libraries, the HMAC key is the literal UTF-8 text of the secret, including its aha-whsec- or aha-rsec- prefix.

Pass the exact bytes of the request body. Parsing and re-encoding the JSON changes the bytes and breaks the signature.

final verifier = WebhookVerifier(webhookSecret);
try {
  final event = verifier.verify(body: rawBody, headers: request.headers);
  // Handle the event, then answer 2xx.
} on WebhookVerificationException {
  // Not verified: answer 400 and drop the delivery.
} on InvalidPayloadException {
  // Authentic, but not decodable: store the body and answer 2xx.
}

Constructors

WebhookVerifier(String secret, {Duration tolerance = const Duration(minutes: 5), DateTime clock()?})

Creates a verifier for secret, the secret returned when the webhook or route was created.

Properties

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

tolerance → Duration

The largest allowed difference between the delivery timestamp and the current time, in either direction.

final

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

verify({required String body, required Map<String, String> headers}) → WebhookEvent

Verifies a delivery and parses its body into a WebhookEvent.

verifyBytes({required List<int> body, required Map<String, String> headers}) → WebhookEvent

Like verify, for a body given as the raw bytes of the request.

verifySignature({required String body, required Map<String, String> headers}) → void

Verifies the signature and timestamp of a delivery without parsing its body.

verifySignatureBytes({required List<int> body, required Map<String, String> headers}) → void

Like verifySignature, for a body given as the raw bytes of the request.

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

sign({required String secret, required String id, required DateTime timestamp, required String body}) → String

Computes the webhook-signature value for a delivery: v1, followed by the base64 signature.

signedHeaders({required String secret, required String id, required DateTime timestamp, required String body}) → Map<String, String>

Builds the webhook-id, webhook-timestamp and webhook-signature headers of a signed delivery, for testing webhook handlers.

Constants

idHeader → const String

The name of the header with the delivery ID.

signatureHeader → const String

The name of the header with the signatures.

timestampHeader → const String

The name of the header with the Unix timestamp in seconds.