I'm having some issues validating the WebHook that Xero sends to Salesforce...
The body of the WebHook sent from Xero must be encrypted using HMAC-SHA0-256, and the response Status Code returned back to Xero must be 200 if success and 401 if failure. Xero will NOT allow you to receive WebHooks until they verify that your endpoint is accepting the correct body and returning the correct response back.
So I used the following:
RestContext.request.headers.get('x-xero-signature') == EncodingUtil.base64Encode( Crypto.generateMac( 'HMACSHA256', Blob.valueOf(RestContext.request.requestBody.toString()), EncodingUtil.base64Decode(Label.Xero_WebHook_Key) ) )
The Label.Xero_WebHook_Key is a Key that is given to us from Xero to use when generating the hash.
The x-xero-signature header is the already hashed body and it must match the hash that we generate in Apex. But no matter what I have tried I cannot seem to get this to work and return the correct response.
Has anyone managed to get this working? I got this working in Node.js, but can't for the life of me see any issues or reasons why it isn't working in Apex :/
var hmac = crypto.createHmac("sha256", xeroConfig.webhookKey).update(req.body.toString()).digest("base64");