I’m having issues validating a Xero webhook intent to receive.
Here is the Xero documentation:
The Xero documentation states :
If the payload is hashed using HMACSHA256 with your webhook signing key and base64 encoded, it should match the signature in the header. This is a correctly signed payload . If the signature does not match the hashed payload it is an incorrectly signed payload .
To gain Intent to receive validation, the receiving url must respond with status: 200 Ok for all correctly signed payloads and respond with status: 401 Unauthorized for all incorrectly signed payloads .
It looks like you are validating the signature of the headers NOT the JSON body. To fix this you will have to reconstitute the JSON exactly as it was transmitted and then go through the signature validation. Or dirty little secret you could just always return 200. At least for now. Although blindly accepting data is always a very bad security practice.
Yes, I tried to return a 200 to get it set up but I get the following error when trying to validate it with Xero:
How do you "reconstitute the JSON exactly as it was transmitted and then go through the signature validation? How do I do this with the “only when” condition?
@chad5 we’ve only used Zapier. Go to Zapier and see which Xero events can trigger a Zap. I think it’s invoice and contact changes. From there you can setup a Bubble step to send the data to your webhook.
(2) This solution would NOT support multiple Xero accounts for different Bubble users in one Bubble app. We only have this configured into a 1:1 relationship Xero to Bubble.
