If an api key is provided when the webhook was setup, we send it in the Authorization header.
The webhook secret is a value that Papaya will use to sign all webhook notification requests (the signature is included in the request’s X-Papaya-Hmac-Sha256 header). If you omit this value, a generated secret is provided. This value can never be retrieved again, so you must persist it immediately.
To verify the request came from papaya, you can calculate the hmac and compare it to the header value.
# json_string is body of the request, webhook_secret is set when the webhook was set up.
calculated_hmac = Base64.strict_encode64(
OpenSSL::HMAC.hexdigest(
OpenSSL::Digest.new('sha256'),
webhook_secret,
json_string
)
)
papaya_hmac = request.headers['X-Papaya-Hmac-Sha256']
Receiving webhooks
When a webhook event that you’ve subscribed to occurs, Papaya sends a POST request to your server endpoint with the details of the event. You can verify the authenticity of these requests in the following ways:
The request’s Authorization header matches the value you provided when subscribing to notifications.
The request’s Heroku-Webhook-Hmac-SHA256 header contains the HMAC SHA256 signature of the request body (signed with the secret value provided when subscribing).
A resulting webhook notification request resembles the following:
POST <https://example.com/hooks>
Authorization: Bearer 01234567-89ab-cdef-0123-456789abcdef
X-Papaya-Hmac-Sha256: cLM15U5x+jHEkANnVasRwBw2yEHu94pXdjcT9Hajc1M=