@@ -0,0 +1,2305 @@
+import javax.crypto.Mac;%0Aimport javax.crypto.spec.SecretKeySpec;%0Aimport javax.servlet.http.HttpServletRequest;%0Aimport java.security.InvalidKeyException;%0Aimport java.security.NoSuchAlgorithmException;%0Aimport java.util.ArrayList;%0Aimport java.util.Base64;%0Aimport java.util.List;%0Aimport java.util.Map;%0Aimport java.util.TreeMap;%0A%0Apublic class CallbackVerifier %7B%0A%0A    private boolean verify(HttpServletRequest request, String apiKey) %7B%0A        String url = String.format(%22%25s://%25s%25s%22, request.getScheme(),%0A                request.getServerName(), request.getServletPath());%0A%0A        // Sort the params%0A        Map%3CString, String%5B%5D%3E sortedParameters =%0A                new TreeMap%3C%3E(request.getParameterMap());%0A%0A        // Join and encode parameters%0A        List%3CString%3E flattenedParameters = new ArrayList%3C%3E();%0A        for (Map.Entry%3CString, String%5B%5D%3E entry : sortedParameters.entrySet()) %7B%0A            for (String value : entry.getValue()) %7B%0A                flattenedParameters.add(entry.getKey() + %22=%22 + value);%0A            %7D%0A        %7D%0A        String parameterString = String.join(%22&%22, flattenedParameters);%0A%0A        // Read the nonce from the request%0A        String nonce = request.getHeader(%22x-authy-signature-nonce%22);%0A%0A        // Join all the request bits using '%7C'%0A        String data = String.format(%22%25s%7C%25s%7C%25s%7C%25s%22,%0A                                    nonce,%0A                                    request.getMethod(),%0A                                    url,%0A                                    parameterString);%0A%0A        try %7B%0A            // Compute the signature%0A            Mac sha256_HMAC = Mac.getInstance(%22HmacSHA256%22);%0A            SecretKeySpec secret_key = new SecretKeySpec(apiKey.getBytes(),%0A                    %22HmacSHA256%22);%0A            sha256_HMAC.init(secret_key);%0A            String hash = Base64%0A                    .getEncoder()%0A                    .encodeToString(sha256_HMAC.doFinal(data.getBytes()));%0A%0A            // Extract the actual request signature%0A            String signature = request.getHeader(%22x-authy-signature%22);%0A%0A            // Compute the request signature with your computed signature%0A            return hash.equals(signature);%0A        %7D catch (NoSuchAlgorithmException %7C InvalidKeyException e) %7B%0A            e.printStackTrace();%0A            return false;%0A        %7D%0A    %7D%0A%7D%0A

Add verify 2FA webhook signature Java snippet