Description
Production-ready signed-webhook verification.
A microservice that validates HMAC-SHA256 signatures in constant time (Standard Webhooks / Svix), rejects requests older than 5 minutes, and guarantees idempotency via Redis keyed on the webhook-id — so a duplicated payment can’t grant access twice.
Requirements: Python + Redis.
Status: 5/5 tests passing.
Honest limitation: this is a manual implementation of the standard — the official provider helper wasn’t published yet when this was built. Not included: your own business logic (provisioning, licensing, database).
Reviews
There are no reviews yet.