APF.HmacValidator 7.1.1.10

AndDone Webhook HMAC Validator

Overview

The AndDone Webhook HMAC Validator library provides a simple way to validate webhook payloads received from AndDone.

It verifies that the webhook data:

• Was sent by AndDone
• Has not been altered in transit

The library handles all canonicalization and HMAC computation internally. In most cases, no manual signature logic is required.

Installation

NuGet Package

Install via .NET CLI:

dotnet add package APF.HmacValidator

Or via Package Manager Console:

Install-Package APF.HmacValidator

NuGet Package: https://www.nuget.org/packages/APF.HmacValidator

Usage

1. Deserialize the Webhook Payload

Deserialize the incoming JSON payload into the provided model:

var webhook = JsonConvert.DeserializeObject<WebhookNotification<WebhookTransaction>>(json);

2. Validate the Signature

var validator = new HmacValidator();
var isValid = validator.ValidateHmac(webhook, secretKey);

• secretKey is your shared secret (base64-encoded)
• Returns true if valid, false otherwise

How It Works

This library validates the webhook by computing an HMAC-SHA256 hash over a canonical representation of the payload.

The signature is not based on the raw JSON body.

Instead, the library:

1. Extracts specific fields from the deserialized object
2. Orders them deterministically
3. Converts values into a normalized string format
4. Joins values using :
5. Computes the HMAC-SHA256 hash
6. Compares the result to the Signature field

Canonicalization Rules

Field Selection

Included fields:

• EventCode
• EventDateTime
• All fields from EventBody

Excluded fields:

• Signature
• Version

Field Order

Field order is fixed and must match the model exactly.

Top-level fields:

1. EventCode
2. EventDateTime

EventBody fields:

MerchantId
MerchantReference
TransactionId
TransactionDate
TimeZone
PSPReference
PaymentIntentId
PaymentMethod
TransactionStatus
TransactionOrigin
SettlementDate
MaskAccount
RoutingNumber
Amount
CardType
FirstName
LastName
AddressLine1
AddressLine2
City
State
Country
PostalCode
Success
ErrorMessage
ReasonCode
AccountToken
CreateAccountToken
QuoteKey        (only if Version >= 2)
SubTotal        (only if Version >= 2)

Value Formatting

• Values are converted to strings
• Values are joined using :
• Field names are not included

Formatting rules:

• null → empty value ("")
• Booleans → True / False
• Numbers → normalized (e.g., 505.0 → 505)

Important Notes

• The signature is not based on raw JSON
• JSON formatting, whitespace, and property order do not affect validation
• Validation depends on:
  • exact field order
  • consistent value formatting

Any deviation will result in a signature mismatch.

Manual Validation (Reference Only)

This library performs HMAC validation internally.

If you are not using this library, you must:

1. Reconstruct the canonical string exactly as defined above
2. Base64-decode your shared secret
3. Compute:

HMAC-SHA256(canonical_string, decoded_key)

4. Base64-encode the result
5. Compare it to the Signature field

Summary

Deserialize → Validate → Done

The library handles canonicalization and HMAC validation internally.

7.1.1.10

• Updated the Webhook OutboundPayment
• Updated the Webhook VendorManagement