SIGNATURE
Verify the notice came from Cord.
Every delivery carries X-Cord-Signature-V1 with a timestamp and the HMAC-SHA256 of the raw body, signed with your endpoint's secret. You validate it in a few lines before processing the event, and the timestamp protects you from someone replaying an old delivery.
- X-Cord-Event-Id to deduplicate without reading the body
- X-Cord-Attempt tells you which delivery attempt it is
- During a rotation it signs with both the new and the previous secret
import crypto from 'node:crypto';
// header = req.headers['x-cord-signature-v1'], rawBody = unparsed body
export function verifyCord(rawBody, header, secret) {
const parts = header.split(',');
const t = parts.find((p) => p.startsWith('t='))?.slice(2);
if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
const expected = crypto.createHmac('sha256', secret)
.update(`${t}.${rawBody}`).digest();
// during a rotation two v1 values arrive: one match is enough
return parts.filter((p) => p.startsWith('v1=')).some((p) => {
const got = Buffer.from(p.slice(3), 'hex');
return got.length === expected.length && crypto.timingSafeEqual(got, expected);
});
}