topic Re: Verify WebHook Notifications example in Integration and Testing

Verify WebHook Notifications example

ashish1871 — Tue, 24 Jul 2018 21:11:29 GMT

The documentation here https://developer.authorize.net/api/reference/features/webhooks.html#Verifying_the_Notification talks about the verification process for WebHook response. Is there and example available on how to implement this in Java?

Re: Verify WebHook Notifications example

Anurag — Tue, 24 Jul 2018 23:11:15 GMT

Hi @ashish1871

You can have a look at this repo https://github.com/dns12345/AuthNet.WebHooks

We are also in progress of building a sample app for Webhooks which will be published soon .

Thanks

Re: Verify WebHook Notifications example

coppercup — Thu, 23 Aug 2018 22:05:20 GMT

This link no longer works.

Re: Verify WebHook Notifications example

Anurag — Thu, 23 Aug 2018 22:07:58 GMT

Try this link

https://github.com/dns12345/AuthNet.WebHooks/tree/master/AuthNet.WebHooks

Also checkout our new Webhook Sample App at https://github.com/AuthorizeNet/webhooks-sample-app

Thanks

Re: Verify WebHook Notifications example

attb2 — Thu, 30 May 2019 14:12:20 GMT

I had the exact same problem:

How to verify X-Anet-Signature?

So I have to use raw json encoded string as received on my endpoint. Without any modification, concatenation of name-value pairs with specials characters etc.

It is very simple! Why not mentioned in the official documentation?

It only says:

"The client application can generate the same HMAC-SHA512 hash using the webhook notification's body and the merchant's Signature Key."

And poor developer does not understand what "body" means... :-)

Re: Verify WebHook Notifications example

chaitalisedin18 — Wed, 16 Dec 2020 15:04:07 GMT

I have followed the documentation for verifying the notification as well as Ruby code for it: https://github.com/AuthorizeNet/sample-code-ruby/blob/master/Sha512/compute-transhash-sha512.rb

Still, the signature generated by me and the X-ANET-Signature is not matching.

Can you please guide me with Ruby code to generate the HMAC-SHA512 hash?

Re: Verify WebHook Notifications example

nan40411 — Thu, 25 May 2023 20:59:06 GMT

Hi,

I write down a nodejs code and it doesn't work all the time. Sometimes it matches and sometimes it doesn't match. What could be the reason?

const crypto = require('crypto');

app.post("/authorize/payment/created", (req, res)=> {

const hash = crypto.createHmac('sha512', signature_key)

.update(JSON.stringify(req.body))

.digest('hex')

.toUpperCase();

if ("sha512="+hash != req.headers["x-anet-signature"]) {

console.log({

result: false,

header: req.headers["x-anet-signature"],

hash

})

// do something

return;

}

// do something

});

Re: Verify WebHook Notifications example

scottiescott — Tue, 19 Dec 2023 09:34:32 GMT

You guys really need to update your API documentation, something so ridiculously simple once again made difficult due to lack of documentation.

Re: Verify WebHook Notifications example

scottiescott — Tue, 19 Dec 2023 09:35:50 GMT

its not "x-anet-signature" its case sensitive so it should be

X-ANET-Signature

Re: Verify WebHook Notifications example

JeffGTech — Wed, 10 Jan 2024 16:38:03 GMT

If you're using Java, get HmacUtils from commons-codec. Then you just pass your sig key like so and can compare with hmacHex on the body. It will return the hash as a string then you just compare them.

HmacUtils h = new HmacUtils(HMAC_SHA_512, "<SIG_KEY>");
h.hmacHex("<REQUEST_BODY>");