The product calls the operator on this path.

3.1 Integration Information

The operator stores a signatureKey and checks callbacks with it.

Property	Type	Description
signatureKey	string	HMAC secret. Use a placeholder, not a real key

3.2 Request Headers

Read these headers before trusting the body.

Header	Type	Description
sapi-timestamp	string	Unix time in milliseconds from the request header
sapi-signature	string	Hex HMAC-SHA256 of the signing string

3.3 Signature Generation

Signing String

Join the raw body, a dot, and the sapi-timestamp header.

Part	Type	Description
rawBodyString	string	JSON body text before it is parsed
sapi-timestamp	string	Unix time in milliseconds from the request header

HMAC-SHA256

Hash that string with HMAC-SHA256 and signatureKey. Encode the digest as hex.

3.4 Examples

Placeholder values only. Do not send these as real credentials.

Raw Data

Use your own placeholders. A real key does not belong in this file.

Property	Value
signatureKey	00000000-0000-4000-8000-000000000000
sapi-timestamp	1700000000000
Request Body (JSON)

Step 1 — Serialize the request body

Sign the JSON text you actually send. Do not reformat it after that.

Step 2 — Build the signing string

Join the raw body, a dot, and the sapi-timestamp header.

Step 3 — Compute HMAC-SHA256

Hash that string with HMAC-SHA256 and signatureKey. Encode the digest as hex.

3.5 Signature Example Code

Placeholder values only. Do not send these as real credentials.

JavaScript / Node.js

In Node, crypto.createHmac("sha256", signatureKey).update(rawBody + "." + timestamp).digest("hex").

PHP

In PHP, hash_hmac("sha256", $rawBody . "." . $timestamp, $signatureKey).

3.6 Verification Flow

Recompute the hex digest and compare it to sapi-signature in constant time. A mismatch uses status code 30002.