Class WebhookSecret

java.lang.Object
com.kingsrook.qqq.backend.core.utils.webhooks.WebhookSecret
public final class WebhookSecret extends Object
A webhook signing secret (Standard Webhooks format).

The text form is whsec_ followed by the base64 of the key bytes. The HMAC key is the decoded bytes. A secret without the prefix is used as raw UTF-8 bytes, so a secret shared with an older receiver still works.

toString() never reveals the key: it prints the fingerprint.

  • Field Details

    • PREFIX

      public static final String PREFIX
      See Also:

    • GENERATED_KEY_BYTES

      public static final int GENERATED_KEY_BYTES
      Key length for generated secrets, in bytes (256 bits).
      See Also:

    • MINIMUM_KEY_BYTES

      public static final int MINIMUM_KEY_BYTES
      Shortest key accepted, in bytes (128 bits).
      See Also:

  • Method Details

    • generate

      public static WebhookSecret generate()
      A new random secret.

    • parse

      public static WebhookSecret parse(String text)
      Parse the text form (whsec_<base64>, or raw text).

    • reveal

      public String reveal()
      The text form to give a receiver (whsec_<base64>).

    • keyBytes

      public byte[] keyBytes()
      The HMAC key (a copy).

    • fingerprint

      public String fingerprint()
      A short, non-reversible id for the secret (first 12 hex chars of its SHA-256), safe to store and show, so people can tell secrets apart.

    • toString

      public String toString()
      Never prints the key.
      Overrides:
      toString in class Object

    • equals

      public boolean equals(Object o)
      Equal when the keys are equal (constant time).
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Hash of the fingerprint.
      Overrides:
      hashCode in class Object