public static boolean isValidSignature ( String requestBody , String signatureHeader , String webhookEndpointSecret ) { String computedSignature = new HmacUtils ( HmacAlgorithms . HMAC_SHA_256 , webhookEndpointSecret ) . hmacHex ( requestBody ) ; return MessageDigest . isEqual ( signatureHeader . getBytes ( ) , computedSignature . getBytes ( ) ) ; }
Validates that a webhook was genuinely sent by GoCardless by computing its signature using the body and your webhook endpoint secret and comparing that with the signature included in the Webhook - Signature header .