Skip to content

feat: add webhook signing and verification helper to sdk#32

Open
khanavi272-spec wants to merge 4 commits intoMissBlue00:mainfrom
khanavi272-spec:feat/webhook-signature
Open

feat: add webhook signing and verification helper to sdk#32
khanavi272-spec wants to merge 4 commits intoMissBlue00:mainfrom
khanavi272-spec:feat/webhook-signature

Conversation

@khanavi272-spec
Copy link
Copy Markdown

@khanavi272-spec khanavi272-spec commented Mar 24, 2026

Fixes #16

Description

This PR adds webhook security support by introducing HMAC-SHA256 signing and verification helpers in the JavaScript SDK.

It enables merchants to verify the authenticity of webhook payloads using a shared helper function and a secret key.

Fixes #105


Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Changes Made

  • Added signWebhookPayload helper to generate HMAC-SHA256 signatures
  • Added verifyWebhookSignature helper for secure verification
  • Exported helpers via SDK index
  • Added documentation for webhook verification (docs/webhooks.md)

How Has This Been Tested?

  • Built the SDK successfully using pnpm build
  • Verified that signatures generated using the same payload and secret match correctly
  • Verified that mismatched payloads or secrets fail validation

Additional Notes

  • Signature is expected to be sent in the x-stellarpay-signature header
  • Merchants should verify using the raw request body to avoid mismatches

@vercel
Copy link
Copy Markdown

vercel bot commented Mar 24, 2026

@khanavi272-spec is attempting to deploy a commit to the missblue00's projects Team on Vercel.

A member of the Team first needs to authorize it.

@drips-wave
Copy link
Copy Markdown

drips-wave bot commented Mar 24, 2026

@khanavi272-spec Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@MissBlue00
Copy link
Copy Markdown
Owner

Hi @khanavi272-spec fix the ci/cd issue

@khanavi272-spec
Copy link
Copy Markdown
Author

I fixed the CI lockfile issue and pushed the update. The remaining workflow appears to be awaiting maintainer approval.

@MissBlue00
Copy link
Copy Markdown
Owner

@khanavi272-spec the ci/cd checks are still failing, please resolve

@khanavi272-spec
Copy link
Copy Markdown
Author

@MissBlue00 Please Merge it

@khanavi272-spec
Copy link
Copy Markdown
Author

@MissBlue00 please merge it

1 similar comment
@khanavi272-spec
Copy link
Copy Markdown
Author

@MissBlue00 please merge it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Webhooks: Implement HMAC-SHA256 signature verification

2 participants