Verify Webhook Signature
lexware_verify_webhook_signatureVerify Lexware webhook signatures by comparing the X-Lxo-Signature header against the raw request body, confirming authenticity via RSA-SHA512 and the official public key.
Instructions
Verify a Lexware webhook X-Lxo-Signature (RSA-SHA512, base64) against the raw request body. Pass the EXACT raw HTTP body bytes you received — do not JSON.parse/stringify round-trip, as Lexware signs the compact JSON as transmitted (whitespace and key order matter). On first call the public key is fetched once from developers.lexware.io and cached for the process lifetime; set LEXWARE_WEBHOOK_PUBLIC_KEY (PEM) to override (recommended for production where you cannot tolerate one-time TLS-substitution risk on the public-key fetch).
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"payload": "<payload>",
"signature": "<signature>"
},
"name": "lexware_verify_webhook_signature"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Raw HTTP request body received from Lexware (verbatim, untransformed). | |
| signature | Yes | Value of the X-Lxo-Signature header (base64). |