> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://buildwithfern.com/learn/llms.txt.

## 2.15.0

**`(feat):`** Support webhook body-hash binding in generated signature verification helpers.
When a webhook signature declares a body-hash binding, the helper now recomputes
the encoded hash of the raw request body, extracts the transmitted hash from the
configured query parameter of the notification URL, and timing-safe-compares them
(failing closed) before verifying the outer HMAC over the verbatim notification URL.

**`(feat):`** Generate HMAC webhook signature verification helpers from the IR.

**`(feat):`** Extend the generated `verifySignature` webhook helper with Twilio-compatible
verification, mirroring the TypeScript reference:

* Multi-value form params: when `payloadFormat.bodySort` is set, the request-body
  parameter accepts either a raw string or a `string|array` multimap of POST body
  parameters whose values are a string or a list of strings; keys are sorted, each
  key's values are deduped and sorted, and `key . value` pairs are concatenated with
  no separator before signing.
* Runtime body-hash branch: when a `bodyHashBinding` is configured, the configured
  query parameter is read from the notification URL at runtime. When present (JSON) the
  raw body is hashed and constant-time compared and the signature is checked over the
  URL only; when absent (classic form) the signature is checked over the URL + params
  with no body-hash check.
* No-throw: the verifier is a pure boolean. Every throw on the verification path (null
  or empty inputs, a missing/malformed timestamp) now returns `false`.
* URL any-match normalization: when `notificationUrlNormalization` is configured, the
  signature is verified against several normalized notification-URL candidates
  (standard-port/no-port variants and legacy query re-encoding), accepting on the first
  constant-time match. A stdlib-only `notificationUrlCandidates` method (using
  `parse_url`/`http_build_query`) is added to the `WebhookSignature` core utility.
  Output is unchanged for webhooks that do not configure these fields, other than the
  no-throw behavior which applies to all generated helpers.

## 2.14.1

**`(fix):`** Render the selected environment's URL template(s) when server URL variables
(e.g. region) are provided alongside a named environment. Previously the
first environment's template was always used, so
`new Client(environment: Environments::Staging(), region: 'ie1')` resolved
to Production-shaped URLs. A custom environment or explicitly provided
base URL is left untouched.