# `CorvoNfse.Webhooks`
[🔗](https://github.com/corvo-technology/corvo-nfse-elixir/blob/main/lib/corvo_nfse/webhooks.ex#L1)

Webhook signature verification.

Corvo signs every webhook delivery with HMAC-SHA256 over the **raw** request
body using your endpoint secret, and sends the hex digest in the
`X-Corvo-Signature` header as `sha256=<hex>`.

## Example

    {:ok, raw_body, _conn} = Plug.Conn.read_body(conn)
    [signature] = Plug.Conn.get_req_header(conn, "x-corvo-signature")

    true = CorvoNfse.Webhooks.verify_signature(raw_body, signature, secret)

Always verify against the **raw** body, before any JSON parsing or
re-serialization. Comparison is constant-time (`:crypto.hash_equals/2`).

# `verify_signature`

```elixir
@spec verify_signature(binary(), String.t() | nil, String.t()) :: boolean()
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*