From b82b4c19c6687593da6064c81d0e8c242628bf33 Mon Sep 17 00:00:00 2001
From: Minh Vu <vuhoangminh97@gmail.com>
Date: Wed, 29 Jul 2026 23:07:49 +0200
Subject: [PATCH] fix(webhooks): apply method-level options

---
 webhooks/webhook.go      |  3 ++-
 webhooks/webhook_test.go | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/webhooks/webhook.go b/webhooks/webhook.go
index 71f3c708a..8555d38b6 100644
--- a/webhooks/webhook.go
+++ b/webhooks/webhook.go
@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -109,7 +110,7 @@ func (r *WebhookService) VerifySignatureWithTolerance(body []byte, headers http.
 // tolerance specifies the maximum age of the webhook.
 // now allows specifying the current time for testing purposes.
 func (r *WebhookService) VerifySignatureWithToleranceAndTime(body []byte, headers http.Header, tolerance time.Duration, now time.Time, opts ...option.RequestOption) error {
-	cfg, err := requestconfig.PreRequestOptions(r.Options...)
+	cfg, err := requestconfig.PreRequestOptions(slices.Concat(r.Options, opts)...)
 	if err != nil {
 		return err
 	}
diff --git a/webhooks/webhook_test.go b/webhooks/webhook_test.go
index 52aaa7ba6..5b11a01d1 100644
--- a/webhooks/webhook_test.go
+++ b/webhooks/webhook_test.go
@@ -42,6 +42,41 @@ func TestWebhookService_VerifySignature_ValidSignature(t *testing.T) {
 	}
 }
 
+func TestWebhookService_VerifySignature_MethodLevelSecret(t *testing.T) {
+	client := openai.NewClient(option.WithAPIKey("test-key"))
+
+	fixedTime := time.Unix(testTimestamp, 0)
+	err := client.Webhooks.VerifySignatureWithToleranceAndTime(
+		[]byte(testPayload),
+		createTestHeaders(),
+		5*time.Minute,
+		fixedTime,
+		option.WithWebhookSecret(testSecret),
+	)
+	if err != nil {
+		t.Errorf("VerifySignatureWithToleranceAndTime should have succeeded with a method-level secret: %v", err)
+	}
+}
+
+func TestWebhookService_VerifySignature_MethodLevelSecretOverridesClientSecret(t *testing.T) {
+	client := openai.NewClient(
+		option.WithAPIKey("test-key"),
+		option.WithWebhookSecret("wrong-secret"),
+	)
+
+	fixedTime := time.Unix(testTimestamp, 0)
+	err := client.Webhooks.VerifySignatureWithToleranceAndTime(
+		[]byte(testPayload),
+		createTestHeaders(),
+		5*time.Minute,
+		fixedTime,
+		option.WithWebhookSecret(testSecret),
+	)
+	if err != nil {
+		t.Errorf("VerifySignatureWithToleranceAndTime should have preferred the method-level secret: %v", err)
+	}
+}
+
 func TestWebhookService_VerifySignature_InvalidSignature(t *testing.T) {
 	client := openai.NewClient(
 		option.WithAPIKey("test-key"),