Interface IPaymentWebhookVerifier
Checks that a webhook really came from the provider, and reads it.
public interface IPaymentWebhookVerifierRemarks
A webhook endpoint is public, so the signature is the whole of its authentication: an unverified body is an anonymous stranger's, and acting on one would let anybody mark a bill paid.
Methods
Verify(string, string?, PaymentWebhookEndpointType)
The event, when the signature matches; a failure when it does not.
IResult<PaymentEventDTO> Verify(string payload, string? signature, PaymentWebhookEndpointType endpoint = PaymentWebhookEndpointType.Platform)Parameters
payloadstringThe request body exactly as received. Re-serializing it — even into an equivalent document — breaks the signature, so it has to be read as a string before anything parses it.
signaturestringThe signature header the provider sent it with.
endpointPaymentWebhookEndpointTypeWhich endpoint it arrived on, for providers that sign each one separately.