lib/Webhook.php
public static function isSignatureValid($request_body, $signature_header, $webhook_endpoint_secret)
    {
        $computed_signature = hash_hmac("sha256", $request_body, $webhook_endpoint_secret);
        return hash_equals($computed_signature, $signature_header);
    }
public static function isSignatureValid($request_body, $signature_header, $webhook_endpoint_secret)
    {
        $computed_signature = hash_hmac("sha256", $request_body, $webhook_endpoint_secret);
        return hash_equals($computed_signature, $signature_header);
    }
public static function isSignatureValid ( $ request_body , $ signature_header , $ webhook_endpoint_secret ) { $ computed_signature = hash_hmac ( "sha256" , $ request_body , $ webhook_endpoint_secret ) ; return hash_equals ( $ computed_signature , $ signature_header ) ; }
Validates that a webhook was genuinely sent by GoCardless by computing its
signature using the body and your webhook endpoint secret, and comparing that with
the signature included in the `Webhook-Signature` header.

@param  string $request_body            the request body
@param  string $signature_header        the signature included in the request, found in the `Webhook-Signature` header
`Webhook-Signature` header
@param  string $webhook_endpoint_secret the webhook endpoint secret for your webhook
endpoint, as configured in your GoCardless Dashboard
@return boolean whether the webhook's signature is valid
Validates that a webhook was genuinely sent by GoCardless by computing its signature using the body and your webhook endpoint secret and comparing that with the signature included in the Webhook - Signature header .