Hook & Events

const signature = crypto
  .createHmac("sha256", api_key)
  .update(JSON.stringify(req.body))
  .digest("hex");
if (signature == req.headers["x-swim-token"]) {
  // Body is signed and valid. Goodluck
}

package hmacexample;
import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.bind.DatatypeConverter;
import org.json.JSONException;
import org.json.JSONObject;
public class HMacExample {
  public static void main(String[] args) throws UnsupportedEncodingException, InvalidKeyException, NoSuchAlgorithmException, JSONException {
    String key = "YOUR_API_KEY"; //replace with your key
    String rawJson = "{}";
    JSONObject body = new JSONObject(rawJson);
    String result = "";
    String HMAC_SHA256 = "HmacSHA256";
    String signature = ""; //put in the request's header value for x-swim-token
    byte [] byteKey = key.getBytes("UTF-8");
    SecretKeySpec keySpec = new SecretKeySpec(byteKey, HMAC_SHA256);
    Mac sha256_HMAC = Mac.getInstance(HMAC_SHA256);
    sha256_HMAC.init(keySpec);
    byte [] mac_data = sha256_HMAC.
    doFinal(body.toString().getBytes("UTF-8"));
    result = DatatypeConverter.printHexBinary(mac_data);
    if(result.toLowerCase().equals(signature)) {
      // you can trust the event, it came from woodcore
      // respond with the http 200 response immediately before attempting to process the response
    }else{
      // this isn't from woodcore, ignore it
    }
  }
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "net/http"
    "io/ioutil"
)

func main() {
    apiKey := "YOUR_API_KEY" // replace with your woodcore
    reqBody := `{"example": "data"}` // replace with actual request body

    // Create HMAC-SHA256 signature
    h := hmac.New(sha256.New, []byte(apiKey))
    h.Write([]byte(reqBody))
    signature := hex.EncodeToString(h.Sum(nil))

    // Simulate incoming request with headers
    req, err := http.NewRequest("POST", "https://example.com", nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }
    req.Header.Set("x-swim-token", signature)

    // Read the x-swim-token header from the request
    xSwimToken := req.Header.Get("x-swim-token")

    // Verify the signature
    if signature == xSwimToken {
        fmt.Println("Body is signed and valid. Good luck")
    } else {
        fmt.Println("Invalid signature")
    }
}

import hmac
import hashlib
signature = request.headers.get("x-wc-signature")
key = secret_key.encode("utf-8")
mes = json.dumps(payload, separators=(',', ':')).encode("utf-8")
encoded_payload = hmac.new(key, mes, hashlib.sha256).hexdigest()
if encoded_payload == signature:
   return True
else:
   return False