Skip to content
Gasket

Verify Gasket's signatures

Make sure tool and webhook requests really came from Gasket.

Tool requests and webhook deliveries carry Gasket-Signature: t=<unix>,v1=<hex>, an HMAC-SHA256 of t + "." + the raw body with your secret. Recompute it, compare in constant time, and reject timestamps older than five minutes.

text
const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const ok = Math.abs(Date.now() / 1000 - +t) < 300 &&
  crypto.timingSafeEqual(Buffer.from(crypto.createHmac("sha256", secret).update(t + "." + rawBody).digest("hex")), Buffer.from(v1));