oci-fn-webhook-signature-verifier

What it does

The first useful run is a pass or fail decision with the provided and computed signature both visible. That is enough to make the boundary inspectable before you add a webhook gateway, database write, or retry behavior.

Try it locally

python3 - <<'PY'
import json, hmac, hashlib
from func import verify_signature
payload = '{"event":"invoice.paid","id":"evt_123"}'
secret = 'topsecret'
provided = hmac.new(secret.encode('utf-8'), payload.encode('utf-8'), hashlib.sha256).hexdigest()
valid, computed = verify_signature(secret, payload, provided)
print(json.dumps({"valid": valid, "provided_signature": provided, "computed_signature": computed}, indent=2))
PY

Example output

{
  "valid": true,
  "provided_signature": "723b7093e99ad943b3c5f2afe02f66a1e0c2306c26a3cf76fc52be0173ff337d",
  "computed_signature": "723b7093e99ad943b3c5f2afe02f66a1e0c2306c26a3cf76fc52be0173ff337d"
}

Where it helps

Use this when a signed webhook flow should prove the verification boundary first, then layer in auth, replay protection, or downstream event handling after the contract is clear.