Orders Webhook

package main

import (
    "crypto/ed25519"
    "encoding/base64"
)

func verifyWebhook(payload []byte, signature string, checksumKey string) (bool, error) {
    // Decode the checksum key (base64 encoded Ed25519 public key)
    publicKey, err := base64.StdEncoding.DecodeString(checksumKey)
    if err != nil {
        return false, err
    }

    // Decode the signature
    signatureBytes, err := base64.StdEncoding.DecodeString(signature)
    if err != nil {
        return false, err
    }

    // Verify the signature against the entire payload body
    return ed25519.Verify(publicKey, payload, signatureBytes), nil
}

import java.security.PublicKey;
import java.security.Signature;
import java.security.spec.X509EncodedKeySpec;
import java.security.KeyFactory;
import java.util.Base64;

public class WebhookVerifier {

    public static boolean verifyWebhook(
        String payloadBody,
        String signature,
        String checksumKey
    ) throws Exception {
        // Decode the public key (base64 encoded)
        byte[] publicKeyBytes = Base64.getDecoder().decode(checksumKey);

        // Create Ed25519 public key
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(publicKeyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance("Ed25519");
        PublicKey publicKey = keyFactory.generatePublic(keySpec);

        // Decode the signature
        byte[] signatureBytes = Base64.getDecoder().decode(signature);

        // Verify the signature against the entire payload body
        Signature s = Signature.getInstance("Ed25519");
        s.initVerify(publicKey);
        s.update(payloadBody.getBytes("UTF-8"));

        return s.verify(Base64.getDecoder().decode(signature));
    }
}