Authentication & Security

curl https://staging.api.sohopay.xyz/api/v1/agents/agt_7d1e5b2f \
  -H "Authorization: Bearer $SOHOPAY_API_KEY" \
  -H "Content-Type: application/json"

import { SohoPay } from "@sohopay/sdk";

const sohopay = new SohoPay({
  apiKey: process.env.SOHOPAY_API_KEY,
  baseUrl: "https://staging.api.sohopay.xyz/api/v1",
});

const agent = await sohopay.agents.get("agt_7d1e5b2f");

import os
from sohopay import SohoPay

sohopay = SohoPay(
    api_key=os.environ["SOHOPAY_API_KEY"],
    base_url="https://staging.api.sohopay.xyz/api/v1",
)

agent = sohopay.agents.get("agt_7d1e5b2f")

import crypto from "crypto";

export function verifyWebhookSignature({
  rawBody,
  signature,
  timestamp,
  signingSecret,
  toleranceInSeconds = 300,
}: {
  rawBody: string;
  signature: string;
  timestamp: string;
  signingSecret: string;
  toleranceInSeconds?: number;
}): boolean {
  // 1. Prevent replay attacks by checking timestamp age
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp, 10)) > toleranceInSeconds) {
    return false;
  }

  // 2. Compute expected HMAC-SHA256 signature
  const signedPayload = `${timestamp}.${rawBody}`;
  const expectedSignature = crypto
    .createHmac("sha256", signingSecret)
    .update(signedPayload)
    .digest("hex");

  // 3. Timing-safe comparison to prevent side-channel attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expectedSignature, "hex")
  );
}

import hmac
import hashlib
import time

def verify_webhook_signature(
    raw_body: str,
    signature: str,
    timestamp: str,
    signing_secret: str,
    tolerance_in_seconds: int = 300,
) -> bool:
    # 1. Prevent replay attacks
    current_time = int(time.time())
    if abs(current_time - int(timestamp)) > tolerance_in_seconds:
        return False

    # 2. Compute expected HMAC-SHA256 signature
    signed_payload = f"{timestamp}.{raw_body}".encode("utf-8")
    expected_signature = hmac.new(
        signing_secret.encode("utf-8"),
        signed_payload,
        hashlib.sha256,
    ).hexdigest()

    # 3. Timing-safe comparison
    return hmac.compare_digest(signature, expected_signature)