checksum error when try to register a webhook through bbb-webhooks

[kemy law]

I have set up a website and a BigBlueButton video server on a local network. The website's IP address is 10.0.0.70, and it has no domain configured. The BigBlueButton server's IP address is 10.0.0.75, running BigBlueButton version 2.7, with the domain bbb.mybbb.com, using an internal CA certificate, and it is working properly.

I have installed bbb-webhooks.

Now, I want to send a request from the website using PHP to register a webhook on the BigBlueButton server. Here's the code I am using:

<?php
$base_url = "https://bbb.mybbb.com/bigbluebutton/api/hooks/create";
$callback_url = "http://10.0.0.70/bbbhook";
$meeting_id = "X12345";
$event_id = "user-joined";
$secret = "RqvID1G1mUMm1VbzUt1CjqyoF6Fgi1ZnZHDtKdTGQo";

$data_body = "callbackURL=" . $callback_url . "&meetingID=" . $meeting_id . "&eventID=" . $event_id;

$checksum_string = $callback_url . $data_body . $secret;

$checksum = sha1($checksum_string);

$final_url = "https://bbb.mybbb.com/bigbluebutton/api/hooks/create?" . $data_body . "&checksum=" . $checksum;


$arrContextOptions = array(
    "ssl" => array(
        "verify_peer" => false,
        "verify_peer_name" => false,
    ),
);

$response = file_get_contents($final_url, false, stream_context_create($arrContextOptions));

echo $response;
?>
When I run this code, I get the following error:


<response>
<returncode>FAILED</returncode>
<messageKey>checksumError</messageKey>
<message>You did not pass the checksum security check.</message>
</response>


The error indicates that the checksum is incorrect. However, according to the bbb-webhooks documentation, the checksum should be generated using sha1(<callback URL> + <data body> + <shared secret>), which I believe I have followed correctly. The secret I used is the shared secret of the BigBlueButton server.

Some online sources mention that I should use the shared secret from the /usr/local/bigbluebutton/bbb-webhooks/config/default.yml file. I checked, and the shared secret in that default.yml file is the same as the BigBlueButton server's shared secret.

Is there any possibility that I misunderstood the content of the data body?

I would appreciate any help. Thank you!