2 docs tagged with "hmac"

Receive Shopify order webhooks, verify the base64 X-Shopify-Hmac-Sha256 signature (is_valid_hmac with encoding: base64 — Shopify base64-encodes its digest where GitHub/Stripe/Slack use hex), and upsert orders into Postgres idempotently, with a recent-orders and paid-revenue reporting endpoint.

Verified Slack slash-command endpoint: checks the X-Slack-Signature HMAC before logging the command to Postgres and replying with an ephemeral message.