Webhooks

Receive signed events at your own endpoints whenever a scan starts, a subject verifies or fails, a proof token is issued, or a token is revoked (including automatic Okta deactivations).

Add endpoint

Endpoint URL (https)

Description

Verifying signatures

Each request carries EasyPeasy-Signature: t=…,v1=… — an HMAC-SHA256 of {t}.{raw body} with your signing secret. Reject anything older than five minutes.

// Node.js receiver
const [t, v1] = req.headers['easypeasy-signature']
  .split(',').map((p) => p.split('=')[1]);
const expected = crypto.createHmac('sha256', process.env.EASY_WHSEC)
  .update(`${t}.${rawBody}`).digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))
    || Date.now() / 1000 - Number(t) > 300) return res.sendStatus(400);