Maya Webhook Signature Verification: Environment‑specific key handling

Maya Webhook Signature Verification: Environment‑specific key handling

Goal: Validate that the integration can correctly verify webhook signatures when operating in the Maya sandbox, ensuring that the same code path works in production without hard‑coding keys or changing logic.

Constraints: Maya documentation states that sandbox and production use distinct base URLs and key pairs. It is unclear whether the signature algorithm or key format changes between environments, and whether a separate public key endpoint is exposed for sandbox verification.

Uncertainty: If the sandbox uses a different HMAC secret or RSA public key, the verification routine may need to adapt, potentially breaking the idempotent processing logic that relies on a consistent signature scheme.

• Does Maya expose a distinct public key or HMAC secret for sandbox webhook verification?
• Are the cryptographic algorithms (e.g., HMAC‑SHA256 vs. RSA‑SHA256) identical across sandbox and production?
• Can the sandbox simulate duplicate or replayed webhook deliveries to test idempotency logic?