I tried to verify the signature sent with Defender Webhooks events but was struggling until I found a bug.
Environment
Defender 2.0 Webhooks
Python 3.12, fastapi
Details
Python dumps JSON differently than Javascript (which I assumed is used on your side).
This is why the example shown in Defender documentation does not work:
Bug is located in line
payload_to_verify_str = json.dumps(payload_to_verify)
it should include separators argument to match javascript .stringify()
payload_to_verify_str = json.dumps(payload_to_verify, separators=(',', ':'))
Thats it. Please update the docs once you confirm that the fix ^^ works.