verifySignature static method

bool verifySignature(
  1. String secret,
  2. Map<String, dynamic> payload,
  3. String? signature
)

Verifies that signature is the correct HMAC-SHA256 signature for payload under secret, using a constant-time comparison to avoid timing side-channels.

Implementation

static bool verifySignature(
  String secret,
  Map<String, dynamic> payload,
  String? signature,
) {
  if (signature == null || signature.trim().isEmpty) return false;
  final expected = signRequest(secret, payload);
  return _constantTimeEquals(expected, signature.trim());
}