Paddle Webhook Verifier

What is it?

A small utility library (without any external dependecies) for verifying paddle webhooks via Public key and given signature. Paddle is an online payment gateway and more details about verifying paddle webhooks can be found on their official documentation.

How to get it?

Maven

Include it in your Maven projects.

<dependency>
  <groupId>com.jamiussiam</groupId>
  <artifactId>paddle-verifier</artifactId>
  <version>2.1</version>
</dependency>

Gradle

Include it in your Gradle projects.

implementation 'com.jamiussiam:paddle-verifier:2.1'

Jar File

You can download the *.jar file from release.

How to use it?

Using Paddle Verifier is very easy. Firstly, import it from the package.

import com.jamiussiam.paddle.verifier.Verifier;

Then use it as shown,

String publicKey;
String postBody;

Verifier verifier = new Verifier(publicKey);
boolean isValid = verifier.verifyDataWithSignature(postBody);

Detailed Guide

Constructor Parameter

publicKey is quite self explanatory, it's the String representation of your public key. For example,

String publicKey =  "-----BEGIN PUBLIC KEY-----\n" +
                    "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAIfVXds6Dfo+EZGFcOJPuhUverHOConA\n" +
                    "j51EQuVpAEhPw6PgyZCi504jxNgiGj6YVOkEJtz5C2d3mgJzsBJs6fUCAwEAAQ==\n" +
                    "-----END PUBLIC KEY-----\n";

Method Parameter

postBody is your POST data from Paddle webhook and it should be in this format,

alert_id=1688369608&balance_currency=GBP&balance_earnings=438.94&balance_fee=689.32  ....

It should contain p_signature key. The key value pairs should be separated by & and the post body should be URL Encoded. (Paddle does this by dafault)

Spring Boot

In spring boot, you can define the bean by,

String publicKey;

@Bean
public Verifier getVerifier() {
    return new Verifier(publicKey);
}

Then, inject it inside your Controller or Component like,

@Autowired
Verifier verifier;

Finally, you can use it to verify incoming requests from Paddle,

@PostMapping(value = "/webhook/", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
private boolean webhook(HttpEntity<String> httpEntity) {

    // Get the validity staus of the request
    boolean isValid = verifier.verifyDataWithSignature(httpEntity.getBody());

    if (isValid) {
        // ... your logic goes here
    }

    return isValid;
}