How to verify the signature of a webhook posted from the Quickbooks Online, in Ruby on Rails.

quickbooks_webhooks_controller.rb

def create
  digest = OpenSSL::Digest.new('sha256')
  hmac = OpenSSL::HMAC.digest(digest, ENV['QUICKBOOKS_VERIFIER'], request.body.read)
  base64 = Base64.encode64(hmac).strip
  if base64 == request.headers['intuit-signature']
    # valid!
    render nothing: true, status: 201
  else
    # not valid!
    render text: 'Invalid signature', status: 400
  end
end

The QUICKBOOKS_VERIFIER value is obtained from your Quickbooks developer dashboard.

https://developer.intuit.com/docs/0100_accounting/0300_developer_guides/webhooks

You saved me many hours of research and testing. Thanks man. Quickbooks docs suck.

Very helpful. Thank you!

Amazing, appreciate this.