curl -X GET "https://olp-api.nipuntheekshana.com/v1/webhooks/public-key" \
-H "Authorization: Bearer <your_jwt_token>"
{
"publicKey": "MCowBQYDK2VwAyEA...",
"algorithm": "ED25519"
}
Webhooks
Get Public Key
Retrieve the ED25519 public key used to verify webhook payload signatures
GET
/
v1
/
webhooks
/
public-key
curl -X GET "https://olp-api.nipuntheekshana.com/v1/webhooks/public-key" \
-H "Authorization: Bearer <your_jwt_token>"
{
"publicKey": "MCowBQYDK2VwAyEA...",
"algorithm": "ED25519"
}
Authentication
This endpoint requires a Bearer token in theAuthorization header.
Authorization: Bearer <your_jwt_token>
Response
string
The ED25519 public key in base64 encoding. Use this key to verify the
X-Signature header on incoming webhook requests.string
The signature algorithm used. Always
ED25519.Signature Verification
Each webhook request includes anX-Signature header containing an ED25519 signature of the raw request body. To verify:
- Retrieve the public key from this endpoint (cache it, as it rarely changes).
- Read the raw request body bytes from the incoming webhook.
- Verify the
X-Signatureheader value against the body using the ED25519 public key.
Node.js Example
const crypto = require("crypto");
function verifyWebhookSignature(publicKeyBase64, signature, body) {
const publicKey = Buffer.from(publicKeyBase64, "base64");
const signatureBuffer = Buffer.from(signature, "base64");
return crypto.verify(null, Buffer.from(body), {
key: publicKey,
format: "der",
type: "spki"
}, signatureBuffer);
}
curl -X GET "https://olp-api.nipuntheekshana.com/v1/webhooks/public-key" \
-H "Authorization: Bearer <your_jwt_token>"
{
"publicKey": "MCowBQYDK2VwAyEA...",
"algorithm": "ED25519"
}