verify-webhook

Documentation

Overview

Verify a FastPix webhook signature before trusting the payload.

FastPix signs the raw request body with your webhook Signing Secret (Dashboard > Webhooks) and sends it as a Base64 HMAC-SHA256 in the "FastPix-Signature" header. The Signing Secret is itself Base64-encoded, so sign with its decoded bytes as the key. Verify the body exactly as received: parsing and re-serializing changes the bytes and the signature won't match.

Run:

go run ./examples/verify-webhook