Verifying webhook signatures

Spaycial pushes data to your system to inform you about events over webhooks.

Request format

A few common points about the requests we send to your registered webhook URL:

• The Content-Type header is application/json.
• The request carries signature headers that identify it as coming from Spaycial (see below).
• The request method is always POST.

Signature headers

The following headers are sent so you can verify the request is coming from Spaycial:

• Expires-at - request expiration time as a UNIX timestamp in UTC timezone. We suggest using +1 minute from the current time.
• Signature - base64 encoded SHA256 signature of the string represented as Expires-at|push_url|post_body|, 3 parameters concatenated with a vertical bar |, signed with Spaycial's private key.

The pseudocode to generate the signature looks like this:

base64(sha256_signature(private_key, "Expires-at|push_url|post_body|"))

The fields making up the signed string:

• push_url - the full URL where data is pushed.
• post_body - the request body.

Use the following public key to verify the signature.

Sandbox

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwfc/T2Pv+ua5pUBqtVdK
+mtl7dphlPuI3jtYifTCEIhahNN8ZFtJwcYeuKwZxcFowO2zL/YQ4468Jj9jdKgb
A4JBOyWELHRawt9opTGuHEzyrl4VHG27bKrFYfOJwsyMEUjKSCxeRr173qkhIolr
MWnqgCtydBsnFZocghbWknoupl+aAEgesmLteHFNvfoQAeoJJLOvpA2ieQvLiTWE
h+oaSPuLN+ftRgUIY6DrAOOQFBtMtcVY2p6ZR27R1TgHr2YMWKxB/DUNVmaUsW/t
MVf+QOkmPLwKOrz/HjyZNLqh+vhmrsrc97dyImmnd1yjuciFtNzMwCmTO8lQ94uk
FwIDAQAB
-----END PUBLIC KEY-----

Production

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXYksIu868s8b+KPwisC
UjEozQQTpQeQzaIqhDFB32htYPQJSjmZ8zoKHcInbmrunglRgtqxB5c0KxzjdUjZ
9U3hXk7MsJPKxcpFyWll8frDuMhvxK9Ly+OGqLdQSwQjjkf65fsKSyuKCUM5ww7S
V3mH4uili4p9+61ctGbtYQiqUJls8No/YAZBjSpgm7KZFK7ILYaFb03KeHxF4qv1
7Wdk002hH2UCZ62faLA9mX34safBNzC5fjAc7VXKRt+3TSzPcjLrHnbYnDzH3Diu
q5sHDtuiwVvGonzDe2wKWgAAnugSAGFyPHsfX36cGq1KwA4ivwVX2lDsl5uOLkkU
KwIDAQAB
-----END PUBLIC KEY-----

An example of the string used to generate the signature (POST): 1522249849|https://www.api.yourdomain.com/customer_subscription|{"event": "customer_subscription", ...}|

Headers example:

{
    "Expires-at": "1522249849",
    "Signature": "0o7LgMnlG7FX5tWLoKd6V5jlktodP8I/3vWqh1pOZvPgMn/WPq5YqZWPc0teey135RO2muFThcvuZJtcbaUje1UWFHyWhTh89guHJ47pgBB7w0LMkRw3XskEsafEUZketeTY/NtyeU7ETHHm2Tlw8IJho+gk51Rtp7JJPanw2OZG/6BElFcL0qGs4ohTmJUKKsdI1eo5jseFqF+sX0T4dRYqL7ebhDCD8YsYdsZ9zxlX88+YtUQnEqGbswOH4saGaQNH9NjxST2NS8MFtCU7uwZGybBk4i0l1wtbTJwfgaa+yb2L7l0ltIgxZFJzQOShpVOgI+o8fUg31lOblmMVkpyvXJ/n5Ed2u0nA1yMWkQUPpu03Xkh2RG7qbBOEq6+A374OnhUDwi5TUqYrY89paPwq/A7z2lc56Q84T+NrSLdi0x0aejpp6Cn90Yqpbs04dIio579+KyLm/8XoZ4p9k7vz6vTpDITyTAc93/KHnqeT1hTp7AWMaxuGfEI361fyZLDzkSvnHq4QzMkJOKhPELxSji99dm0LCSZpUiUhTTU3G09LvLBCEFLvbGJzxlO7NgqOGVPMlEc4fJqzU/jrTfkodn4DtzaOJghlXynithKIUBAkpNY8QGPOQIMvcbOZfhilm+bjWuYeNpeALvbqY3ONcibHLjc8ItAVMzORSFg=",
    "Content-Type": "application/json",
    "Accept": "application/json"
}