Dart SDK - Webhooks#

Outbound HTTP notifications with HMAC-signed deliveries.

Create and manage#

final hook = await db.webhooks.create(
  name: 'order.created',
  url: 'https://myapp.com/hooks/orders',
  events: ['order.created'],
  secret: 'signing-secret', // used to HMAC-sign deliveries
);

await db.webhooks.list();
await db.webhooks.update(hookId, enabled: false);
await db.webhooks.remove(hookId);

DART

Deliveries#

await db.webhooks.listDeliveries(hookId);
await db.webhooks.send(hookId);                        // test delivery
await db.webhooks.retryDelivery(hookId, deliveryId);

DART

Verifying deliveries on your server#

Every delivery includes an X-Afribase-Signature header in the form sha256=<hex> (HMAC-SHA256 of the body with the webhook's secret), plus X-Afribase-Event and X-Afribase-Delivery headers.

import 'dart:convert';
import 'package:crypto/crypto.dart';

bool verifyWebhook(String rawBody, String signatureHeader, String secret) {
  final expected = Hmac(sha256, utf8.encode(secret))
      .convert(utf8.encode(rawBody))
      .toString();
  final received = signatureHeader.replaceFirst(RegExp('^sha256='), '');
  return expected == received;
}

DART

Next: Edge functions.