signWebhook function

String signWebhook(
  1. String payload,
  2. String timestamp,
  3. String secret
)

Produces the digest MisarMail sends in X-Misar-Signature.

Public because verification is only half the job: testing a webhook consumer needs a valid signature, and the exact framing (timestamp + "." + body) is where that usually goes wrong.

Implementation

String signWebhook(String payload, String timestamp, String secret) {
  final mac = Hmac(sha256, utf8.encode(secret));
  return mac.convert(utf8.encode('$timestamp.$payload')).toString();
}