Background
#854 (shipped v0.9.0) added pluggable drt serve auth (--auth none|bearer|hmac) with HMAC-SHA256 body-signature verification covering GitHub (sha256=<hex>), Shopify (base64), and bare-hex senders. The CHANGELOG entry for #854 explicitly named what it does not cover:
Stripe's timestamped scheme and Pub/Sub's OIDC JWT are not covered — OIDC is a filed follow-up (#903 — it needs a JWT dependency decision), and until it lands Pub/Sub push still needs a verifying proxy.
OIDC got tracked as #903. Stripe's scheme didn't get its own issue — this is that follow-up, filed for parity with #903 rather than left as a dangling CHANGELOG mention.
Why Stripe needs a different code path
Stripe's Stripe-Signature header is not a plain HMAC-over-body like GitHub/Shopify: it's t=<timestamp>,v1=<hex>[,v0=<hex>], and the signed payload is <timestamp>.<body>, not the body alone. Verification also requires a replay-window check (Stripe's own libraries default to 5 minutes) comparing t against wall-clock time — a check the existing GitHub/Shopify/bare-hex schemes have no equivalent of, since none of them sign a timestamp.
Scope
- New
--hmac-scheme stripe (or equivalent) alongside the existing header-name/encoding options in drt/cli/commands/serve.py's HMAC auth path
- Parse
Stripe-Signature, verify v1 against HMAC-SHA256(secret, f"{t}.{body}")
- Reject on stale timestamp (configurable tolerance, default matching Stripe's own 5-minute recommendation)
- Docs:
docs/guides/using-webhook-trigger.md's per-scheme auth setup table gains a Stripe row alongside GitHub/Shopify/bare-hex
Out of scope
References
Background
#854 (shipped v0.9.0) added pluggable
drt serveauth (--auth none|bearer|hmac) with HMAC-SHA256 body-signature verification covering GitHub (sha256=<hex>), Shopify (base64), and bare-hex senders. The CHANGELOG entry for #854 explicitly named what it does not cover:OIDC got tracked as #903. Stripe's scheme didn't get its own issue — this is that follow-up, filed for parity with #903 rather than left as a dangling CHANGELOG mention.
Why Stripe needs a different code path
Stripe's
Stripe-Signatureheader is not a plain HMAC-over-body like GitHub/Shopify: it'st=<timestamp>,v1=<hex>[,v0=<hex>], and the signed payload is<timestamp>.<body>, not the body alone. Verification also requires a replay-window check (Stripe's own libraries default to 5 minutes) comparingtagainst wall-clock time — a check the existing GitHub/Shopify/bare-hex schemes have no equivalent of, since none of them sign a timestamp.Scope
--hmac-scheme stripe(or equivalent) alongside the existing header-name/encoding options indrt/cli/commands/serve.py's HMAC auth pathStripe-Signature, verifyv1againstHMAC-SHA256(secret, f"{t}.{body}")docs/guides/using-webhook-trigger.md's per-scheme auth setup table gains a Stripe row alongside GitHub/Shopify/bare-hexOut of scope
References
drt servedelivery contract + pluggable auth)docs/guides/using-webhook-trigger.md— the contract + per-scheme auth setup doc to extend