I have set up a webhook and is receiving events sent to my webhook url. However, the events sent did only include my secret set in the endpointAuthorization in the on of the two validation requests, after that the Authorization header is missing.
There is a "X-HEALTHAPI-SIGNATURE" header added to the events, and the documentation about this says the following:
Authorization mechanism for a subscriber endpoint. For all requests sent by the Webhooks service, the JSON payload is cryptographically signed. The signature is delivered in the X-HEALTHAPI-SIGNATURE HTTP header. This is an ECDSA (NIST P256) signature of the JSON payload. Clients must verify this signature using Google Health API's public key to confirm the payload was sent by the Health API.
This Google Health API public key can't be found anywhere. How can I validate this header and verify that the event is sent from Google, and why is a public key used instead of my secret?
best regards
Alexander
