Checking Webhook Signatures

Webhook requests contain a Signature header. The signature can be used to verify the webhook request is coming from [3P].
Before you can verify signatures, you'll need to retrieve the environment's public key from [our] JWKS endpoint. This will
return the current public JSON Web Key Set and this will contain one JWK for now.

You’ll need to convert the JWK to a RSA Public Key.
URL Decode the n parameter & cast to a BigInteger; this is your modulus
URL Decode the e parameter & cast to a BigInteger; this is your public exponent
Then generate the public key using the kty - Key Type
Once you have the RSA Public Key, you can use it to create an RSA Verifier. With the RSA Verifier:
Convert the body to a byte array; and,
Base64 decode the Signature header
Then you'll be able to successfully verify webhook events are safely being sent from [3P].

Example
This is an example JSON Web Key (JWK) -

    {
        "kty": "RSA",
        "kid": "2020-03-18",
        "alg": "RS256",
        "n": "ANV-aocctqt5xDRnqomCgsO9dm4hM0Qd75TqG7z2G5Z89JQ7SRy2ok-fIJRiSU5-
JfjPc3uph3gSOXyqlNoEh4YGL2R4AP7jhxy9xv0gDVtj1tExB_mmk8EUbmj8hTIrfAgEJrDe
B4qMk7MkkKxhHkhLNEJEPZfgYHcHcuKjp2l_vtpiuR9Ouz0febB9K4gLozrp9KHW2Km0z02-tSurxmmij5nnJCEgp0wXcCS4w4G0jve4hcLlL9FU8HKxrb0d4rMQgM3VAal6yG5pwMdtrsch7xAoccwWFC_tHgpDJGNvOJNFtuk7Cit_aom-6U6ssGF13sUtdrog2ePWjVxc=",
        "e": "AQAB"
    }

This is a webhook request whose Signature header along with the JWK above can be used to verify the request body -

headers:

    Signature: 1IJl6VyKU4pYfqMHUd55QBNq5Etbz5a7DOCkID2Nloay76y4f02w2iMXONlyL
/Bx9SkrbivOHW1l1XadkUrd5pKUK1fhpcnItukLrsK5ADQOcuEjSLBg9qJffZYooXfc7hOD
/fV0sN33W2vBYJspbR3P766DwG/6IO/20f9t
/DcSWa79EFZPMnsCicEArNS3iIYBtdZSX5ta5EETt7S8acHbpIlSDrTcYpo0vuz19LQ6SPQq
N2LGdR+U7ZOiUQWdfMXhUgE7w94pHQzcOq1IHfw3CylUEcRR
/DhrGqs4mBaagO6JpWzeqE1uTAiN579kOtSSqjblTb2AXALTQ3+TtA==
    X-Request-ID: ff26b0c3-3a7f-4652-b17a-262da0dd9c85
    Content-Type: application/json

body:

    {"eventId":"569886904","officeId":"132917981","eventType":"
INTEGRATION_DEACTIVATED","event":{"integration":{"status":"INACTIVE","
webhookId":"2bc47eed-08a0-4d18-a5c0-b7f18ab802e3","officeId":"
132917981","createdDateTime":"2020-03-17T23:39:41.804Z","
lastUpdatedDateTime":"2020-03-17T23:39:41.804Z"}},"createdDateTime":"
2020-03-17T23:39:41.806Z"}