Package africa.sendbyte.webhooks

Class WebhookSignature

java.lang.Object

africa.sendbyte.webhooks.WebhookSignature

public final class WebhookSignature
extends Object

Verifies the signature on inbound SendByte webhook requests.

Every delivery carries a "sendbyte-signature" header shaped like t=<unix_seconds>,v1=<hex_hmac_sha256>. The signature is an HMAC-SHA256, keyed with your endpoint's whsec_... secret, over the string "<t>.<raw body>". The timestamp guards against replay attacks.

Always verify against the raw request body bytes, before any JSON parsing — re-serializing decoded JSON can change the bytes and break the check.

 boolean ok = WebhookSignature.verify(
     secret,
     request.getHeader(WebhookSignature.SIGNATURE_HEADER),
     rawBodyBytes);
 if (!ok) { response.setStatus(401); return; }
 

Field Summary

Fields

Modifier and Type	Field	Description
static final Duration	DEFAULT_TOLERANCE	Default replay tolerance: reject deliveries whose timestamp is older than this.
static final String	SIGNATURE_HEADER	The header carrying the signature on every webhook delivery.

Method Summary

Modifier and Type	Method	Description
static String	sign(String secret, long timestampSeconds, byte[] body)	Compute the "sendbyte-signature" header value for a body.
static boolean	verify(String secret, String signatureHeader, byte[] body)	Verify a raw byte body using the default tolerance.
static boolean	verify(String secret, String signatureHeader, byte[] body, Duration tolerance)	Verify a raw byte body against the signature header.
static boolean	verify(String secret, String signatureHeader, String body)	Verify a string body using the default tolerance.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SIGNATURE_HEADER

public static final String SIGNATURE_HEADER

The header carrying the signature on every webhook delivery.

See Also:

• Constant Field Values

DEFAULT_TOLERANCE

public static final Duration DEFAULT_TOLERANCE

Default replay tolerance: reject deliveries whose timestamp is older than this.

Method Details

verify

public static boolean verify(String secret,
 String signatureHeader,
 String body)

Verify a string body using the default tolerance.

verify

public static boolean verify(String secret,
 String signatureHeader,
 byte[] body)

Verify a raw byte body using the default tolerance.

verify

public static boolean verify(String secret,
 String signatureHeader,
 byte[] body,
 Duration tolerance)

Verify a raw byte body against the signature header.

Parameters:

secret - the endpoint's whsec_... signing secret

signatureHeader - the "sendbyte-signature" header value

body - the raw request body bytes, before any parsing

tolerance - maximum age of the signature timestamp; pass Duration.ZERO or a negative value to skip the age check

Returns:

true only if the signature matches and the timestamp is within tolerance

sign

public static String sign(String secret,
 long timestampSeconds,
 byte[] body)

Compute the "sendbyte-signature" header value for a body. Useful for testing and for services that need to emit SendByte-compatible signatures.