Authenticate identity, timestamp and raw bytes under an explicit teaching scheme.
Type: Build Languages: Go Stage: 2 of 4 Prerequisites: Basic functions, collections, JSON and the previous stages when applicable. Time: ~2 hours
What you build
The authored signature is v1= followed by lowercase HMAC-SHA256 hex over decimalTimestamp + dot + deliveryID + dot + rawBody. The shared secret comes from an environment variable and is never written to the inbox. Verify with hmac.Equal and bound accepted timestamps.
Worked example
At now=1770000000 and a 300-second window, now-300 and now+300 are accepted. now-301 is stale. Altering a single body byte or delivery ID fails authentication even inside the time window.
pj signed webhook inbox 2
Implement the contract
Sign(key []byte,id string,timestamp int64,body []byte)string; Verify(Delivery,key,now,skew)error. Keys require at least 16 bytes; skew must be 0..1 hour. Receiver uses five minutes. This format is original and not compatible with a named webhook provider.
Reject malformed input before producing a partial artifact. The tests include held-out records separate from the demonstration fixture.
Run your work
python3 scripts/project_test.py signed-webhook-inbox --init /tmp/signed-webhook-inbox-work
python3 scripts/project_test.py signed-webhook-inbox --stage 2 --path /tmp/signed-webhook-inbox-work --strictInitialization copies cumulative scaffolding without replacing your work. Implement the TODO functions in the first-stage starter; later-stage starter notes describe the new behavior. Tests import the learner workspace. Run the command in the README against your own input after passing the stage.
Inspect and extend
Add a provider adapter only after implementing and testing its published raw-byte signing rules. Do not assume a different service uses this concatenation order.
Go HMAC and Go SHA-256.