Verifying subscription payloads

Once a subscription is created, you will receive a signingKey in the response.

The signingKey should be stored in your database against the subscription ID.

The sigingKey is used by Tray to generate a HMAC code by signing the event payload.

This HMAC code will be sent as a header (x-tray-signature) along with the event payload to the endpoint you specified in Create Subscription request.

When you receive the event, you should verify the HMAC code before processing the payload.

Here is how you can do it in Node.js:

const crypto = require("crypto");

const generateHMAC = (signingKey, requestBody) => {
  const signingKeyBuffer = Buffer.from(signingKey, "base64");
  return crypto
    .createHmac("sha256", signingKeyBuffer)
    .update(requestBody, "utf-8") //requestBody is your event payload in plain text
    .digest("base64");
};

In the above code block, signingKey is what you get from upon creating subscription the first time.

requestBody will be the event payload (in plain text) that is sent to your endpoint.

The HMAC code generated using the function above should be equal to x-tray-signature header in the request.