verify

type HMAC ¶

type HMAC struct {
	Header   string
	Encoding string // "hex" or "base64"
	Prefix   string
	Secret   []byte
}

HMAC verifies an HMAC-SHA256 signature of the raw request body carried in a single header, optionally prefixed (e.g. GitHub's "sha256=").

func (h *HMAC) Verify(header http.Header, body []byte) error

type Iyzico ¶

type Iyzico struct {
	Secret     []byte
	MerchantID string
}

Iyzico verifies iyzico's X-IYZ-SIGNATURE-V3 webhook signatures.

Unlike GitHub/Stripe, iyzico does not sign the raw body: the signature is HMAC-SHA256 (lowercase hex, secretKey as key) over a concatenation of payload fields, and the field list depends on the event family:

direct       secretKey + iyziEventType + paymentId + paymentConversationId + status
hpp          secretKey + iyziEventType + iyziPaymentId + token + paymentConversationId + status
subscription merchantId + secretKey + iyziEventType + subscriptionReferenceCode +
             orderReferenceCode + customerReferenceCode

The family is detected from the payload shape: a token field means HPP (checkout form / pay-with-iyzico), a subscriptionReferenceCode means subscription, anything else is direct. Subscription events need the merchant id, which is not in the payload — configure verify.merchant_id_env.

Numeric fields (iyziPaymentId is a JSON number) are rendered exactly as they appear in the JSON document via json.Number; re-encoding them through float64 would corrupt large ids and break the signature.

func (v *Iyzico) Verify(header http.Header, body []byte) error

type Stripe ¶

type Stripe struct {
	Secret    []byte
	Tolerance time.Duration
	Now       func() time.Time
}

Stripe verifies Stripe webhook signatures.

Stripe sends a Stripe-Signature header of the form "t=<unix>,v1=<hex>,v1=<hex>,v0=..." where each v1 value is HMAC-SHA256(secret, "<t>.<raw body>"). Multiple v1 entries appear during secret rotation; any single match is accepted. Signatures older (or newer) than Tolerance are rejected to limit replay.

func (s *Stripe) Verify(header http.Header, body []byte) error

type Verifier ¶

type Verifier interface {
	// Verify returns nil if the request is authentic, otherwise a reason
	// suitable for storing alongside the rejected event.
	Verify(header http.Header, body []byte) error
}

Verifier checks the signature of a webhook request.

func Build(v *config.Verify, secret []byte, merchantID string) (Verifier, error)