Webhooks

{
  "id": "evt_0123456789abcdef01234567",
  "type": "verification.created",
  "created_at": "2025-01-01T12:00:00Z",
  "data": {
    "id": "vrf_0123456789abcdef01234567",
    "account_id": "12345",
    "sender_profile_id": "prf_0123456789abcdef01234567",
    "channel": "sms",
    "to": "+61412345678",
    "country": "AU",
    "code_length": 6,
    "status": "pending",
    "attempts": 0,
    "max_attempts": 3,
    "expires_at": "2025-01-01T12:15:00Z",
    "created_at": "2025-01-01T12:00:00Z",
    "updated_at": "2025-01-01T12:00:00Z"
  }
}

Maileroo-Signature: t=1700000000,v1=<hex-signature>

import crypto from "node:crypto";

export function verifyMaileroo(signature, secret, rawBody, now = Date.now()) {
  const parts = Object.fromEntries(signature.split(",").map((part) => part.split("=")));
  if (!/^\d+$/.test(parts.t ?? "") || !/^[0-9a-f]{64}$/.test(parts.v1 ?? "")) return false;
  const timestamp = Number(parts.t);
  const age = Math.abs(Math.floor(now / 1000) - timestamp);
  if (!Number.isSafeInteger(timestamp) || age > 300) return false;

  const expected = crypto
    .createHmac("sha256", Buffer.from(secret, "utf8"))
    .update(Buffer.concat([Buffer.from(`${parts.t}.`, "utf8"), rawBody]))
    .digest();
  const received = Buffer.from(parts.v1, "hex");
  return received.length === expected.length && crypto.timingSafeEqual(expected, received);
}

import hashlib
import hmac
import time

def verify_maileroo(signature, secret, raw_body, now=None):
    parts = {}
    for item in signature.split(","):
        key, separator, value = item.partition("=")
        if not separator:
            return False
        parts[key] = value

    timestamp = parts.get("t", "")
    received = parts.get("v1", "")
    if not timestamp.isascii() or not timestamp.isdigit():
        return False
    if len(received) != 64 or any(char not in "0123456789abcdef" for char in received):
        return False
    try:
        timestamp_value = int(timestamp)
    except ValueError:
        return False
    current_time = time.time() if now is None else now
    if abs(int(current_time) - timestamp_value) > 300:
        return False

    expected = hmac.new(
        secret.encode("utf-8"),
        timestamp.encode("ascii") + b"." + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, received)

function verifyMaileroo(string $signature, string $secret, string $rawBody, ?int $now = null): bool {
    $parts = [];
    foreach (explode(',', $signature) as $item) {
        $pair = explode('=', $item, 2);
        if (count($pair) !== 2) return false;
        $parts[$pair[0]] = $pair[1];
    }

    $timestamp = $parts['t'] ?? '';
    $received = $parts['v1'] ?? '';
    if (!preg_match('/^\d+$/D', $timestamp) || !preg_match('/^[0-9a-f]{64}$/D', $received)) return false;
    if (abs(($now ?? time()) - (int) $timestamp) > 300) return false;

    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $received);
}

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "strconv"
    "strings"
    "time"
)

func verifyMaileroo(header, secret string, rawBody []byte, now time.Time) bool {
    fields := map[string]string{}
    for _, part := range strings.Split(header, ",") {
        key, value, ok := strings.Cut(part, "=")
        if ok {
            fields[key] = value
        }
    }

    timestamp := fields["t"]
    received, err := hex.DecodeString(fields["v1"])
    if err != nil || len(received) != sha256.Size {
        return false
    }
    timestampValue, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil {
        return false
    }
    age := now.Unix() - timestampValue
    if age < 0 {
        age = -age
    }
    if age > 300 {
        return false
    }

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(timestamp + "."))
    mac.Write(rawBody)
    return hmac.Equal(mac.Sum(nil), received)
}