RevenueCat webhook HMAC (onset-web prod)

Cloudflare Pages prod already has REVENUECAT_WEBHOOK_AUTHORIZATION. HMAC is optional defense-in-depth.

Enable in RevenueCat (required once)

The signing secret must originate from RevenueCat, not the other way around. RC shows it only at creation/rotation.

1. RevenueCat dashboard → your Onset project
2. Integrations → Webhooks → open the existing webhook (URL: https://theonset.app/api/webhooks/revenuecat or your prod endpoint)
3. Toggle HMAC webhook signing on
4. Copy the signing secret immediately (shown once)
5. Update secrets to match:
6. BWS Onset project: REVENUECAT_WEBHOOK_SIGNING_SECRET
7. Cloudflare Pages onset-web prod: REVENUECAT_WEBHOOK_SIGNING_SECRET

   cd onset-web
   printf '%s' '<rc-signing-secret>' | npx wrangler pages secret put REVENUECAT_WEBHOOK_SIGNING_SECRET --project-name=onset-web
   

8. Send a test webhook from the RC integration page; confirm Cloudflare logs show 200 (not 401)

Verification

Handler: functions/api/webhooks/revenuecat.js
Verifier: functions/_utils/revenuecat-webhook.js (header X-RevenueCat-Webhook-Signature, format t=<unix>,v1=<hmac>)

If HMAC is enabled in RC but the secret is missing/wrong in Cloudflare, webhooks still pass when REVENUECAT_WEBHOOK_AUTHORIZATION matches. HMAC is only enforced when REVENUECAT_WEBHOOK_SIGNING_SECRET is set.

Note on prior setup

A placeholder secret may exist in BWS/Cloudflare from an earlier ops pass. Rotate in RevenueCat and replace BWS + Cloudflare with RC's generated secret so signatures verify.