API Reference

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
const crypto = require('crypto');

function verify(rawBody, headers, secret) {
  const sigHeader = headers['x-customerhero-signature'] || '';
  const parts = Object.fromEntries(
    sigHeader.split(',').map((p) => p.split('=')),
  );
  const ts = parts.t;
  const v1 = parts.v1;
  if (!ts || !v1) return false;

  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${ts}.${rawBody}`)
    .digest('hex');

  const a = Buffer.from(v1, 'hex');
  const b = Buffer.from(expected, 'hex');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import hmac, hashlib, time

def verify(raw_body: bytes, headers: dict, secret: str) -> bool:
    sig_header = headers.get("X-CustomerHero-Signature", "")
    parts = dict(p.split("=", 1) for p in sig_header.split(",") if "=" in p)
    ts = parts.get("t")
    v1 = parts.get("v1")
    if not ts or not v1:
        return False

    if abs(time.time() - int(ts)) > 300:
        return False

    expected = hmac.new(
        secret.encode(),
        f"{ts}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(v1, expected)

1
2
3
4
5
6
7
8
9
10
11
12
13
require 'openssl'

def verify(raw_body, headers, secret)
  sig_header = headers['X-CustomerHero-Signature'].to_s
  parts = sig_header.split(',').to_h { |p| p.split('=', 2) }
  ts = parts['t']
  v1 = parts['v1']
  return false unless ts && v1
  return false if (Time.now.to_i - ts.to_i).abs > 300

  expected = OpenSSL::HMAC.hexdigest('SHA256', secret, "#{ts}.#{raw_body}")
  Rack::Utils.secure_compare(v1, expected)
end

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
<?php
function verify(string $rawBody, array $headers, string $secret): bool {
    $sigHeader = $headers['X-CustomerHero-Signature'] ?? '';
    $parts = [];
    foreach (explode(',', $sigHeader) as $pair) {
        [$k, $v] = array_pad(explode('=', $pair, 2), 2, null);
        if ($k && $v) $parts[$k] = $v;
    }
    $ts = $parts['t'] ?? null;
    $v1 = $parts['v1'] ?? null;
    if (!$ts || !$v1) return false;

    if (abs(time() - (int)$ts) > 300) return false;

    $expected = hash_hmac('sha256', $ts . '.' . $rawBody, $secret);
    return hash_equals($expected, $v1);
}