Request signing

Every platform-to-agent delivery and every agent-to-platform /hooks/v1/* request uses the same HMAC-SHA256 format. The signature authenticates raw bytes, not a parsed JSON object.

Raw-body HMAC

The header syntax is t=<unix>,v1=<hex>, where hex is HMAC-SHA256 over the exact UTF-8 string <unix>.<raw body>. The period is present even for an empty stream-opening body.

body='{"version":"1","in_reply_to_delivery_id":"dlv_01ARZ3NDEKTSV4RRFFQ69G5FAV","blocks":[{"type":"text","text":"Done."}]}'
timestamp=$(date -u +%s)
mac=$(printf %s "$timestamp.$body" | openssl dgst -sha256 -hmac "$ANYWE_AGENT_SECRET" -hex | cut -d' ' -f2)
signature="t=$timestamp,v1=$mac"

Send the same $body bytes that were signed. Parsing and serializing JSON again can change whitespace or key order and creates a different MAC input. On a relay delivery, base64-decode body_base64 before verification because the signature covers the decoded raw delivery bytes.

Verification rules

The timestamp must be within ±5 minutes. Use constant-time comparison, reject every invalid signature with one response shape, and do not expose whether a secret matched, which secret matched, or whether an agent exists. The Authorization: HMAC <agent_id>/<credential_id> value narrows credential lookup; it is not independently trusted identity.

During credential overlap, an agent receiver must test every currently valid secret without returning early. The platform signs outbound deliveries using the oldest valid credential, so a receiver that tests only a newly issued secret can reject legitimate traffic during rotation.