Module: Mercadopago::Webhook

Defined in:

lib/mercadopago/webhook/validator.rb

Overview

Webhook signature validation utilities.

Verifies the authenticity of incoming MercadoPago webhook notifications by recomputing the HMAC-SHA256 signature locally and comparing it against the value carried in the x-signature header.

The validator is stateless, performs no outbound HTTP calls, and does not depend on any SDK configuration object; the integrator passes the secret signature explicitly on every call.

Examples:

Basic usage

begin
  Mercadopago::Webhook::Validator.validate(
    request.headers['x-signature'],
    request.headers['x-request-id'],
    request.params['data.id'],
    webhook_secret,
    tolerance_seconds: 300
  )
  head :ok
rescue Mercadopago::Webhook::InvalidWebhookSignatureError
  head :unauthorized
end

Defined Under Namespace

Modules: SignatureFailureReason Classes: InvalidWebhookSignatureError, Validator