How to verify webhook signatures correctly: raw body, timing-safe comparison, replay window

·1 views

FlightByte, a flight status API, sends signed webhooks, and its guide explains how receivers should verify them. Each delivery carries a signature header containing a Unix timestamp and an HMAC-SHA256 value computed over the timestamp and the raw request body. The timestamp is included in the signed material so that captured deliveries cannot be replayed with a fresh time. The signature covers exact bytes, so verifiers must read the unparsed raw body, since re-serialising parsed JSON produces different bytes and causes verification to fail. The guide shows framework-specific approaches for Express, Fastify, and Next.js to preserve the raw payload.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ELO Seeks Mid-to-Senior React Frontend Developer for Remote Role

ELO (Effortless Order) is recruiting a React frontend developer for a remote position open to candidates worldwide. The company is building a digital commerce ecosystem intended to link merchants and consumers more directly, starting with online food ordering. The role involves building and maintaining responsive web interfaces, and experience with TypeScript, Next.js, or other modern React frameworks is preferred. Employment may be full-time or contract, with the level flexible for the right mid-level or senior candidate. Applicants are asked to submit a CV or LinkedIn profile, project links, a description of their React experience, location, availability, and expected pay.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

x402 Protocol Lets AI Agents Pay for Web APIs Using Micro-Settlements on Base

Autonomous AI agents struggle to pay for paid APIs because they cannot hold conventional bank accounts, and card processing minimums make tiny per-request charges uneconomical. The x402 protocol addresses this by reviving the long-dormant HTTP 402 Payment Required status code and pairing it with USDC settlement on the Base Layer 2 network, EIP-712 signatures, and HTTP headers. In the flow, a server responds to an agent's request with a 402 challenge specifying the price and payment details, and the agent pays on-chain and retries with a payment proof attached. The article includes a minimal Python client example and argues that subscription-based SaaS models suit human usage poorly compared with bursty agent workloads that require no account provisioning or card details.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OBINexus Lays Out 12-Week Plan to Build OBI Robotics Prototype and Reasoning System

OBINexus Computing has published a 12-week engineering roadmap aimed at turning OBI Robotics from a concept into a testable physical prototype. The plan prioritizes mechanical design first, with CAD assemblies, load calculations and electrical and wiring work, before building intelligence around the hardware's real constraints. Alongside the robot, the Ontological Bayesian Intelligence (OBI) reasoning system is to be developed separately and measured on its own terms, with C/C++ modules and automated tests. The roadmap keeps the physical control loop independent of the AI layer, and it starts with a simple robot base and a small, interpretable Bayesian model rather than a large language model. The authors state that the deliverable is a validated prototype and integration-ready architecture, not a finished autonomous robot.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LLM Wiki Emerges as Simpler Alternative to GraphRAG for Growing Knowledge Bases

A developer on DEV Community compares GraphRAG and LLM Wiki approaches for building LLM-based knowledge bases that keep growing. Both use an LLM to distill raw data, but GraphRAG structures knowledge as entities, relations, and communities, while LLM Wiki organizes it into directories, index pages, and linked documents. The author notes that both share problems such as inaccurate summaries, stale information, lost sources, and difficulty of evaluation. The piece traces the progression from vector RAG in 2023 through GraphRAG, LightRAG, LazyGraphRAG, and the 2026 Relink paper. The author concludes that an LLM Wiki is the better starting point for those building a small knowledge base.

0 comments Read more at DEV Community