Skip to content

Developers

One signed event stream for every provider. Retries run 10 times over about 24 hours, then dead-letter.

Verify signatures

Every event carries a DCP-Signature header and a DCP-Event-Id you can deduplicate on.

DCP-Signature: t=1761136500,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd
import crypto from "node:crypto";

// raw: the request body as a string, before JSON.parse
export function verify(raw, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.${raw}`)
    .digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}