signed-request

A signed request

An API that wants each request signed with a secret key: the collector computes an HMAC-SHA-256 over what the request says, and sends it in a header. Here, the number of messages waiting in a queue.

How to read it

• 'secret' => true on the variable of the key: a secret, never written in a value or a message, never given a default.
• time.now() counts to the millisecond; number.round gives whole seconds.
• "GET\n" . $path . …: between double quotes, \n is a line break. $ in a text is never a variable: "$path" is the text $path.
• hash.sha256(''): the SHA-256 of the body, empty for a GET, in 64 hexadecimal digits.
• hash.hmac_sha256($signed, $key): the signature of the text under the key, in hexadecimal. Made with a secret, it is a secret itself: it only goes into the request.
• A request that carries a secret goes over https:// only: over http://, it stops the collector.

To adapt it

• Each API has its own text to sign: the order of the parts, the separator, the headers it includes. Follow its documentation to the byte.