Verify webhooks in Flutter

The watenga_flutter package exposes a constructEvent helper that verifies the Watenga-Signature header and returns the parsed event map.

Install

Add the dependency to your pubspec.yaml (it depends on package:crypto):

yaml

dependencies:
  watenga_flutter: ^0.1.0

constructEvent

constructEvent(String rawBody, String signatureHeader, String secret, { int toleranceSeconds = 300 }) returns Map<String, dynamic>. It recomputes HMAC-SHA256 over `${t}.${rawBody}`, compares it to v1 in constant time, and throws a StateError if the timestamp is outside the tolerance window or the signature does not match.

Handler

dart

import 'package:watenga_flutter/webhook_verify.dart';

// In your server-side Dart handler (e.g. shelf / dart_frog).
// Verify on the raw request body before acting on it.
void handleWatengaWebhook(String rawBody, Map<String, String> headers) {
  final secret = const String.fromEnvironment('WATENGA_WEBHOOK_SECRET');

  // constructEvent verifies the Watenga-Signature header
  // (t=<unix>,v1=<hmac-sha256-hex>) within the 300s tolerance window
  // and returns the parsed envelope. Throws on failure.
  final event = constructEvent(
    rawBody,
    headers['watenga-signature'] ?? '',
    secret,
  );

  if (event['type'] == 'payment.capture.completed') {
    final data = event['data'] as Map<String, dynamic>;
    // fulfil the order using data['id']
  }
}

Server-side only

Verify webhooks on a server you control — never embed your webhook secret in a shipped mobile app. Always pass the raw, unparsed body. See the Webhooks reference for the signing scheme.