> This page is for SDKs, version Legacy.
> For other versions, use one of these documentation indexes:
> - Current (default): https://buildwithfern.com/learn/sdks/current/llms.txt
> - Legacy: https://buildwithfern.com/learn/sdks/legacy/llms.txt

> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://buildwithfern.com/learn/llms.txt.

## 1.51.0

**`(feat):`** Add body-hash binding verification for HMAC webhooks that transmit a hash of the raw request body in the notification URL.

**`(feat):`** Add webhook signature verification support. When a webhook declares HMAC signature
verification in the IR, the generated Go SDK now emits a `WebhooksHelper` with a
`VerifySignature` method that validates the signature (and optional timestamp) using a
new stdlib-only core utility (`crypto/hmac`/`crypto/sha*`/`encoding` with constant-time
comparison).

**`(feat):`** Extend the generated `VerifySignature` webhook helper with Twilio-compatible
verification, mirroring the TypeScript reference:

* Multi-value form params: when `payloadFormat.bodySort` is set, the `requestBody`
  parameter accepts either a raw string or a `map[string][]string`-shaped multimap of
  POST body parameters; keys are sorted, each key's values are deduped and sorted, and
  `key + value` pairs are concatenated with no separator before signing.
* Runtime body-hash branch: when a `bodyHashBinding` is configured, the configured
  query parameter is read from the notification URL at runtime. When present (JSON) the
  raw body is hashed and constant-time compared and the signature is checked over the
  URL only; when absent (classic form) the signature is checked over the URL + params
  with no body-hash check. The body-hash check runs once above the candidate loop.
* No-throw: the verifier fails closed. Every verification-path failure (null/empty
  inputs, a missing/malformed timestamp, a body-hash type mismatch) now returns
  `false` rather than an error.
* URL any-match normalization: when `notificationUrlNormalization` is configured, the
  signature is verified against several normalized notification-URL candidates
  (standard-port/no-port variants and legacy query re-encoding), accepting on the first
  constant-time match. A stdlib-only `NotificationUrlCandidates` helper (using
  `net/url`) is added to the core webhook utility.
  Output is unchanged for webhooks that do not configure these fields, other than the
  no-throw behavior which applies to all generated helpers.