# `Accrue.Webhook.Signature`
[🔗](https://github.com/szTheory/accrue/blob/accrue-v0.3.0/lib/accrue/webhook/signature.ex#L1)

Webhook signature verification. Delegates entirely to
`LatticeStripe.Webhook.construct_event!/4` (D2-22).

Accrue does NOT implement HMAC verification -- lattice_stripe handles
timing-safe compare, replay tolerance, and multi-secret rotation.

# `verify!`

```elixir
@spec verify!(binary(), String.t() | nil, String.t() | [String.t()], keyword()) ::
  LatticeStripe.Event.t()
```

Verifies the webhook signature and returns the parsed
`%LatticeStripe.Event{}`.

Raises `Accrue.SignatureError` on failure.

`secrets` may be a single string or a list of strings for key
rotation (D2-05, T-2-05).

## Options

  * `:tolerance` - max age in seconds for replay protection
    (default: 300, matching Stripe's default window)

---

*Consult [api-reference.md](api-reference.md) for complete listing*