Validating Xero webhooks

Hello everyone,

Did anyone successfully implement this? I'm attempting a similar thing with Xero's webhooks

Hey @MiguelOrtiz!

Curious to know if you had any luck. Since it's possible to read headers in Workflows I imagine you could use a code block with a library like crypto js to check if the payload has been correctly hashed:

From there you can customize the response code based on the result of your code block to either return a 401 or a 200.

Since this would be built into the same endpoint as the main workflow you're trying to run you'll likely need to add in some additional routing logic for which additional workflow blocks might be helpful:

Hey @Kabirdas,

Thanks for getting back to me. I was not able to implement it succesfully. See below screenshot of how I left things:

I'm not sure how the library would work. I would be super grateful for any advise on how to implement this.
Thanks

Hey @MiguelOrtiz!

This isn't something I've actually implemented but still happy to take a look.

The first thing that pops out is that you'll likely need to use bracket notation to access the x-xero-signature property of the headers object since the key contains hyphens:

Beyond that though, I'd be curious to see what error is actually being thrown either in your workflow logs, or in xero's.

Thanks Kabirdas, hoping to find time for this closer to Christmas, and will get back to you with my outcome.