Verifying webhook authenticity using Spring Boot

Jehudowuf I'm verifying the request via this method and it works in Spring Boot :) arguments for the function come from webhook request: headers you mention and the full request body. Hope it helps :) Compared signatures in the final if statement should be the same.

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import org.apache.tomcat.util.codec.binary.Base64;

......

private final String zendeskSecretKey = "XXXXXXXXXXX_SECRET_FROM_WEBHOOK_CONFIG";

public void validateZendeskWebhookRequest(String zendeskSignatureTimeStamp, String zendeskSignature, String requestBody) throws Exception {
        Mac sha256 = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(zendeskSecretKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        sha256.init(secretKey);
        String signature =
                Base64.encodeBase64String(
                        sha256.doFinal((zendeskSignatureTimeStamp + requestBody).getBytes(StandardCharsets.UTF_8)));

        LOGGER.debug("Request Validation Result: {} vs {}", signature, zendeskSignature);

        if (!zendeskSignature.equals(signature)) {
            throw new ZendeskRequestNotValidException();
        }
}