Get your webhook signing secret

GET 
/applications/webhook_signing_secret

Returns the secret used to sign the webhooks Cocolis sends to your endpoints.

Every webhook call carries an X-Cocolis-Signature header formatted as t=<unix_timestamp>,v1=<signature>, where <signature> is the hexadecimal HMAC-SHA256 of <unix_timestamp>.<raw_request_body> keyed with this secret.

The digest is computed over the raw request body, exactly as sent. Parsing the JSON and re-encoding it before computing the digest yields a different result.

To verify a call: reject it when the timestamp is more than 5 minutes old, recompute the digest over the raw body, and compare it to v1 using a constant-time comparison (Rack::Utils.secure_compare in Ruby, crypto.timingSafeEqual in Node, hmac.compare_digest in Python).

Responses

200

Your webhook signing secret