Method verify_webhook

python/composio/core/models/triggers.py:1190–1259

Verify an incoming webhook payload and signature. This method validates that the webhook request is authentic by: 1. Validating the webhook timestamp is within the tolerance window 2. Verifying the HMAC-SHA256 signature using the correct algorithm 3. Parsing

(
        self,
        *,
        id: str,
        payload: str,
        secret: str,
        signature: str,
        timestamp: str,
        tolerance: int = 300,
    )

        return _SubcriptionBuilder(client=self._client).connect(timeout=timeout)

    def verify_webhook(
        self,
        *,
        id: str,
        payload: str,
        secret: str,
        signature: str,
        timestamp: str,
        tolerance: int = 300,
    ) -> VerifyWebhookResult:
        """
        Verify an incoming webhook payload and signature.

        This method validates that the webhook request is authentic by:
        1. Validating the webhook timestamp is within the tolerance window
        2. Verifying the HMAC-SHA256 signature using the correct algorithm
        3. Parsing the payload and detecting the webhook version (V1, V2, or V3)

        :param id: The webhook message ID from the 'webhook-id' header (format: 'msg_xxx')
        :param payload: The raw webhook payload as a string (request body)
        :param secret: The webhook secret used to sign the payload (from Composio dashboard)
        :param signature: The signature from the 'webhook-signature' header (format: 'v1,base64EncodedSignature')
        :param timestamp: The webhook timestamp from the 'webhook-timestamp' header (Unix seconds)
        :param tolerance: Maximum allowed age of the webhook in seconds (default: 300 = 5 minutes).
                         Set to 0 to disable timestamp validation.
        :return: VerifyWebhookResult containing version, normalized payload, and raw payload
        :raises WebhookSignatureVerificationError: If the signature verification fails
        :raises WebhookPayloadError: If the payload cannot be parsed or is invalid

        Example:
            # In a Flask webhook handler
            @app.route('/webhook', methods=['POST'])
            def webhook():
                try:
                    result = composio.triggers.verify_webhook(
                        id=request.headers.get('webhook-id', ''),
                        payload=request.get_data(as_text=True),
                        signature=request.headers.get('webhook-signature', ''),
                        timestamp=request.headers.get('webhook-timestamp', ''),
                        secret=os.environ['COMPOSIO_WEBHOOK_SECRET'],
                    )

                    # Process the verified payload
                    print(f"Version: {result['version']}")
                    print(f"Received trigger: {result['payload']['trigger_slug']}")
                    return 'OK', 200
                except WebhookSignatureVerificationError:
                    return 'Unauthorized', 401
        """
        # Validate timestamp if tolerance is set
        if tolerance > 0:
            self._validate_webhook_timestamp_header(timestamp, tolerance)

        # Verify signature using the correct algorithm
        self._verify_webhook_signature(
            webhook_id=id,
            webhook_timestamp=timestamp,
            payload=payload,