*/ public function events(): array; /** * Which config keys under the plugin's own config the verification needs, * e.g. `['signing_key']`. Empty means the URL secret is the whole * protection. * * These are the provider's own credentials and they live in the transport * plugin's own configuration, beside the sending credentials it already * keeps. The secret in the webhook URL is a different thing and belongs to * whatever built the URL. * * @return list */ public function verificationKeys(): array; /** * Whether the request is genuinely from the provider. Runs before * {@see parse()} and before the body is read as anything but bytes. * * @param array $config the values of {@see verificationKeys()}, * keyed by the same names */ public function verify(WebhookRequest $request, array $config): Verdict; /** * The events in the body, never throws; unreadable bodies answer * {@see Payload::unreadable()}. */ public function parse(WebhookRequest $request): Payload; /** * The header name the store stamps its send id into, and how to read it * back from an event's raw data. * * The store puts this header on every message it wants to hear about; this * provider's {@see parse()} finds it again wherever that provider chose to * put echoed headers — a top-level key, a `{name, value}` list, a user * variables map, a metadata object — and puts what it finds on * {@see Event::$sendId}. The name is answered here so the store and the * provider cannot disagree about it. */ public function sendHeader(): string; }