[mrSamDev]

Summary

I hit this while building against the Adyen Node.js API library. The "Parsing and Authenticating Banking Webhooks" example in the README never worked. isValid came back false every time.

Root cause

The example calls the deprecated validateBankingHMAC method:

hmacValidator.validateBankingHMAC("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString)

The implementation reads those arguments the other way around. It signs with the first one and compares against the second:

const expectedSign = createHmac(..., Buffer.from(hmacSign, "hex")).update(notification).digest("base64");
return HmacValidator.secureCompare(expectedSign, hmacKey);

Pass (KEY, SIGNATURE) in the order the names suggest and you get false forever. The example is a trap, and a silent one at that.

Fix

Point the example at the non-deprecated validateHMACSignature(hmacKey, hmacSignature, data), which takes its arguments in the order the names suggest:

const isValid = hmacValidator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString)

I checked the implementation in src/utils/hmacValidator.ts and the tests in src/__tests__/hmacValidator.spec.ts before writing this. The change is one line, and it makes the example do what it claims.

[gemini-code-assist]

Code Review

This pull request updates the README.md documentation to use the correct method name validateHMACSignature instead of validateBankingHMAC in the TypeScript example. The reviewer suggested instantiating the HmacValidator class in the example to make it fully functional and clear.

[gemini-code-assist]

The example uses 'hmacValidator' without instantiating it first. Since 'HmacValidator' is a class with instance methods, it should be instantiated before calling 'validateHMACSignature' to make the example fully functional and clear.

Suggested change

	const isValid = hmacValidator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString)
	const hmacValidator = new HmacValidator();
	const isValid = hmacValidator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString);

[mrSamDev]

Good catch on the missing instantiation, but the suggested fix would not work as written: the package does not export HmacValidator (capitalized). src/index.ts exports the class as hmacValidator (lowercase), so new HmacValidator() would throw a ReferenceError.

I updated the example to import and instantiate the exported class:

import { hmacValidator } from "@adyen/api-library";

const validator = new hmacValidator();
const isValid = validator.validateHMACSignature("YOUR_HMAC_KEY", "YOUR_HMAC_SIGNATURE", jsonString);

This matches the usage in the existing tests (new HmacValidator() in src/__tests__/hmacValidator.spec.ts).

[jeandersonbc]

Thank you for the PR @mrSamDev! Indeed, we need to go over some examples and docs that are outdated. Contributions like this one is highly valuable!

[mrSamDev]

Thank you for the PR @mrSamDev! Indeed, we need to go over some examples and docs that are outdated. Contributions like this one is highly valuable!

Thanks! Glad I could help. If I run into any other issues while using the library, I’ll be happy to contribute again.