Validating Webhooks

require 'openssl'
require 'base64'

# webhook_public_key: The PEM-encoded public key from the Webhook object
# x_signature_header: The value of the X-Signature header
# request_body: The raw JSON body of the request

public_key = OpenSSL::PKey::RSA.new(webhook_public_key)
signature = Base64.decode64(x_signature_header)
digest = OpenSSL::Digest::SHA512.new

is_valid = public_key.verify(digest, signature, request_body)

if is_valid
  puts "Signature is valid"
else
  puts "Signature is invalid"
end

<?php

// $webhook_public_key: The PEM-encoded public key from the Webhook object
// $x_signature_header: The value of the X-Signature header
// $request_body: The raw JSON body of the request

$public_key = openssl_pkey_get_public($webhook_public_key);
$signature = base64_decode($x_signature_header);

$is_valid = openssl_verify($request_body, $signature, $public_key, OPENSSL_ALGO_SHA512);

if ($is_valid === 1) {
    echo "Signature is valid";
} elseif ($is_valid === 0) {
    echo "Signature is invalid";
} else {
    echo "Error checking signature";
}