cayu.webhooks

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

verify_webhook_signature

from cayu.webhooks import verify_webhook_signature

Constant-time HMAC verification of a webhook signature.

secret is the non-empty shared webhook secret, body is the raw request body (verify the bytes, never a re-serialized payload), and signature is the provider’s signature header value. Returns True only on an exact, constant-time match.

Defaults verify GitHub’s X-Hub-Signature-256 (sha256 digest, sha256= prefix). For a provider that sends a bare hex digest, pass prefix="". Malformed untrusted signature values return False; invalid verifier configuration raises WebhookSignatureError.

verify_webhook_signature(secret: str | bytes, body: bytes, signature: str | None, *, algorithm: str='sha256', prefix: str='sha256=') -> bool

Release source · Runtime guarantees · Capability guides

webhook_task_id

from cayu.webhooks import webhook_task_id

A deterministic, collision-resistant task id from stable webhook parts.

The same parts always yield the same id, so passing it as TaskCreate(task_id=webhook_task_id("github", delivery_id)) makes a redelivered webhook a no-op: the task store rejects the duplicate id. Pass parts that uniquely identify the delivery (e.g. provider name + delivery id), not the mutable payload.

webhook_task_id(*parts: str, namespace: str='webhook') -> str

Release source · Runtime guarantees · Capability guides

WebhookSignatureError

from cayu.webhooks import WebhookSignatureError

Raised when a signature cannot be computed (e.g. an unsupported algorithm).

Bases: ValueError.

This type’s implementation and inherited behavior are available in the linked release source.

Release source · Runtime guarantees · Capability guides