stripe-clojure.webhooks — io.github.yonureker/stripe-clojure 0.3.0

Provides functions for verifying and constructing Stripe webhook events.

The construct-event function accepts three parameters:

• payload: the raw webhook payload (as a string, exactly as received)
• signature: the 'Stripe-Signature' header value from the request
• endpoint-secret: the webhook secret used to sign the payload

See https://docs.stripe.com/webhooks for more details. NOTE: Pass the raw request body exactly as received.

compute-signature clj

(compute-signature payload secret)

Computes the HMAC SHA-256 signature of the given payload using the provided secret.

construct-event clj

(construct-event payload signature endpoint-secret & [opts])

Constructs and verifies a Stripe event from the raw webhook payload.

This function accepts three required parameters:

• payload: the raw webhook payload (string, exactly as received)
• signature: the 'Stripe-Signature' header value from the request
• endpoint-secret: the secret used to sign the webhook payload An optional fourth parameter (opts) may be provided for configuration (e.g., {:tolerance 300}).

Returns a Clojure map representing the parsed Stripe event if verification succeeds. Throws an ex-info exception with specific messages if verification fails.

generate-test-header-string clj

(generate-test-header-string {:keys [payload secret timestamp signature]
                              :as opts})

Generates a test header string for mocking Stripe webhook events.

Options (provided as a map):

• :payload (string): JSON string of the webhook event payload.
• :secret (string): the webhook secret.
• :timestamp (optional, number): a specific timestamp (in seconds). Defaults to current time.
• :signature (optional, string): a precomputed signature to use instead of computing it.

Returns a header string formatted as "t=<timestamp>,v1=<signature>".

verify-signature clj

(verify-signature payload
                  signature
                  webhook-secret
                  &
                  [{:keys [tolerance]
                    :or {tolerance default-tolerance-in-seconds}}])

Verifies the signature of a Stripe webhook event.

Parameters:

• payload: raw request body as a string.
• signature: the Stripe-Signature header value.
• webhook-secret: the endpoint secret used to sign the payload.
• opts (optional): a map of options such as {:tolerance <seconds>}, default is 300 sec.

Returns true if the signature is valid, otherwise throws an ex-info exception.