Webhook security

SECRET='ezw_...'
TS=$(date +%s)
CANON='{"text":"BUY SOL 500 USDC"}'
PAYLOAD="$TS.$CANON"
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -X POST "https://mcp.echozero.app/api/public/agent-signals/$AGENT_ID" \
  -H "Content-Type: application/json" \
  -H "X-EZ-Timestamp: $TS" \
  -H "X-EZ-Signature: $SIG" \
  -d '{"text":"BUY SOL 500 USDC"}'

import { signInboundWebhook } from '@echozero/sdk';

const body = { text: 'BUY SOL 500 USDC' };
const headers = await signInboundWebhook({
  signingSecret: process.env.EZW_SECRET!,
  body,
});
// headers['X-EZ-Timestamp'], headers['X-EZ-Signature']

import hmac, hashlib, json

def verify_inbound(secret: str, body: dict, timestamp: str, signature: str) -> bool:
    # Use SDK canonical_json in production; see signature test vectors
    from echozero.hmac import canonical_webhook_body  # when SDK published
    canon = json.dumps(body, sort_keys=True, separators=(",", ":"))
    payload = f"{timestamp}.{canon}"
    expected = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

{
  "event": "signal.execution",
  "signalId": "...",
  "developerAgentId": "...",
  "status": "executed",
  "executionResult": {
    "success": true,
    "txHash": "...",
    "executedAmountUsd": 100,
    "executedAt": "2026-07-06T12:00:00.000Z"
  },
  "timestamp": "2026-07-06T12:00:00.000Z"
}

import hmac, hashlib

def verify_outbound(secret: str, raw_body: bytes, timestamp: str, signature: str) -> bool:
    payload = f"{timestamp}.{raw_body.decode()}"
    expected = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

X-Telegram-Bot-Api-Secret-Token: <same value passed to Telegram setWebhook secret_token>

X-Discord-Signal-Webhook-Secret: <matching secret>