webhook-receiver

Overview ¶

Command webhook-receiver shows how to mount the webhook validator behind a stdlib HTTP handler. Each inbound POST is validated against the HMAC-SHA256 signature header before the body is parsed; failures map to 401 / 403 with the matching sentinel.

Run ¶

FLOWCATALYST_SIGNING_SECRET=shh go run ./examples/webhook-receiver

In another terminal:

ts=$(date +%s)
body='{"hello":"world"}'
sig=$(echo -n "${ts}${body}" | openssl dgst -sha256 -hmac shh -hex | awk '{print $2}')
curl -X POST http://localhost:8081/webhook \
    -H "X-FlowCatalyst-Timestamp: $ts" \
    -H "X-FlowCatalyst-Signature: $sig" \
    -H "Content-Type: application/json" \
    -d "$body"