Authlink.Webhooks.ServiceStack 1.0.0

Authlink.Webhooks.ServiceStack

ServiceStack integration for Authlink webhook handling with automatic signature validation.

Installation

dotnet add package Authlink.Webhooks.ServiceStack

Quick Start

Register the plugin in your AppHost using the extension method:

using Authlink.Webhooks.ServiceStack.Extensions;

public class AppHost : AppHostBase
{
    public override void Configure()
    {
        this.AddAuthlinkWebhooks(options =>
        {
            options.SecretConfigKey = "Webhooks:Secret";
        });
    }
}

Usage

Using the Request Filter Attribute

The [ValidateWebhookSignature] attribute validates signatures before your service executes:

using Authlink.Webhooks.ServiceStack.Filters;
using Authlink.Webhooks.Core.Payloads;
using Authlink.Webhooks.Core.Responses;

[ValidateWebhookSignature]
public class WebhookService : Service
{
    public object Post(WebhookEvent<RegistrationCompletingPayload> request)
    {
        // Signature has already been validated
        // Process the webhook...

        return WebhookResponseBuilder.Approve();
    }
}

Customizing Configuration Key

[ValidateWebhookSignature(SecretConfigKey = "Webhooks:RegistrationSecret")]
public class WebhookService : Service
{
    public object Post(WebhookEvent<RegistrationCompletingPayload> request)
    {
        return WebhookResponseBuilder.Approve();
    }
}

Customizing Header Names

[ValidateWebhookSignature(
    SecretConfigKey = "Webhooks:Secret",
    SignatureHeader = "X-Custom-Signature",
    TimestampHeader = "X-Custom-Timestamp")]
public object Post(WebhookEvent<RegistrationCompletingPayload> request)
{
    return WebhookResponseBuilder.Approve();
}

Configuring the Plugin Directly

using Authlink.Webhooks.ServiceStack.Plugins;
using Authlink.Webhooks.ServiceStack.Options;

Plugins.Add(new AuthlinkWebhooksFeature
{
    Options = new WebhookOptions
    {
        Secret = "your-webhook-secret",
        // Or use configuration key
        SecretConfigKey = "Webhooks:RegistrationSecret",
        SignatureHeader = "X-Authlink-Signature",
        TimestampHeader = "X-Authlink-Timestamp"
    }
});

Configuration

Add your webhook secret to your app settings:

{
  "Webhooks": {
    "Secret": "your-webhook-secret-here"
  }
}

Or configure via AppSettings:

SetConfig(new HostConfig {
    AppSettings = new DictionarySettings(new Dictionary<string, string> {
        { "Webhooks:Secret", "your-webhook-secret" }
    })
});

Error Responses

When signature validation fails, the filter returns:

• 401 Unauthorized with { "error": "Missing webhook signature" } if the signature header is missing
• 401 Unauthorized with { "error": "Invalid webhook signature" } if the signature is invalid

Security Features

• HMAC-SHA256 signature validation
• Support for timestamp-based replay attack prevention
• Constant-time signature comparison

Related Packages

• Authlink.Webhooks - Core webhook functionality
• Authlink.Webhooks.Core - Core types and interfaces
• Authlink.Webhooks.AspNetCore - ASP.NET Core integration