Header exact — auth/header_exact

# examples/auth/header_exact.yaml
#
# Reference config demonstrating the header_exact auth strategy.
# Two schemes are registered under this type:
#
#   exact  — constant-time comparison of the header value against secret
#   basic  — HTTP Basic Authorization: decodes base64(user:pass) and compares
#
# Use exact auth for providers that send a static API key or Bearer token
# in a header (e.g. RevenueCat, Shopify admin webhooks).
#
# remove_bearer: true strips the leading "Bearer " prefix before comparison,
# so secret should be just the token value, not the full header value.

server:
  addr: ":8080"
  max_body_bytes: 1048576

destinations:
  primary:
    type: "rabbitmq"
    rabbitmq:
      url: "${RABBITMQ_URL}"
      exchange: "hookway.webhooks"
      exchange_type: "direct"
      durable: true
      publish_timeout: "5s"
      declare_queues: true

flows:
  # RevenueCat-style: static Bearer token in the Authorization header.
  # Set REVENUECAT_WEBHOOK_AUTH to the token value (not the full "Bearer <token>" string).
  revenuecat_billing:
    nodes:
      - {id: in, type: http_trigger, path: /webhooks/revenuecat, methods: [POST]}
      - {id: body, type: read_body, max_bytes: 1048576}
      - {id: auth, type: auth, scheme: exact, secret: "${REVENUECAT_WEBHOOK_AUTH}", signature_header: Authorization, remove_bearer: true}
      - {id: env, type: envelope, body_format: json}
      - {id: out, type: publish, destination: primary, target: revenuecat-events, create: true}
    edges: [in>body, body>auth, auth>env, env>out]

  # basic_webhook (scheme: basic / HTTP Basic Authorization) is omitted.