title: Unable to perform successful Paypal webhook validation
body: <p>I am working to validate Paypal webhook data but I'm running into an issue where it's always returning a FAILURE for the validation status. I'm wondering if it's because this is all happening in a sandbox environment and Paypal doesn't allow verification for sandbox webhook events? I followed this API doc to implement the call: <a href="https://developer.paypal.com/docs/api/webhooks/v1/#verify-webhook-signature" rel="nofollow noreferrer">https://developer.paypal.com/docs/api/webhooks/v1/#verify-webhook-signature</a></p>
  
  <p>Relevant code (from separate elixir modules):</p>
  
  <pre><code>def call(conn, _opts) do
    conn
      |&gt; extract_webhook_signature(conn.params)
      |&gt; webhook_signature_valid?()
      |&gt; # handle the result
  end
  
  defp extract_webhook_signature(conn, params) do
    %{
      auth_algo: get_req_header(conn, "paypal-auth-algo") |&gt; Enum.at(0, ""),
      cert_url: get_req_header(conn, "paypal-cert-url") |&gt; Enum.at(0, ""),
      transmission_id: get_req_header(conn, "paypal-transmission-id") |&gt; Enum.at(0, ""),
      transmission_sig: get_req_header(conn, "paypal-transmission-sig") |&gt; Enum.at(0, ""),
      transmission_time: get_req_header(conn, "paypal-transmission-time") |&gt; Enum.at(0, ""),
      webhook_id: get_webhook_id(),
      webhook_event: params
    }
  end
  
  def webhook_signature_valid?(signature) do
    body = Jason.encode!(signature)
    case Request.post("/v1/notifications/verify-webhook-signature", body) do
      {:ok, %{verification_status: "SUCCESS"}} -&gt; true
      _ -&gt; false
    end
  end
  </code></pre>
  
  <p>I get back a 200 from Paypal, which means that Paypal got my request and was able to properly parse it and run it though its validation, but it's always returning a FAILURE for the validation status, meaning that the authenticity of the request couldn't be verified. I looked at the data I was posting to their endpoint and it all looks correct, but for some reason it isn't validating. I put the JSON that I posted to the API (from <code>extract_webhook_signature</code>) into a Pastebin here cause it's pretty large: <a href="https://pastebin.com/SYBT7muv" rel="nofollow noreferrer">https://pastebin.com/SYBT7muv</a></p>
  
  <p>If anyone has experience with this and knows why it could be failing, I'd love to hear. </p>