NavoChatDeveloper docs
Sign and verify API channel requests
Use raw request bytes, a Unix timestamp, and HMAC-SHA256 to authenticate traffic in both directions.
Updated 2026-07-24For: Backend developers · Security owners
The canonical signing input is:
{timestamp}.{rawBody}
Headers:
X-NavoChat-Timestamp: 1784196000
X-NavoChat-Signature: v1=<hex hmac sha256>
Node.js
import crypto from "node:crypto";
const body = Buffer.from(JSON.stringify(payload));
const timestamp = Math.floor(Date.now() / 1000).toString();
const signature = crypto
.createHmac("sha256", process.env.NAVOCHAT_SIGNING_SECRET)
.update(Buffer.concat([Buffer.from(`${timestamp}.`), body]))
.digest("hex");
Python
import hashlib
import hmac
import time
timestamp = str(int(time.time()))
signature = hmac.new(
secret.encode(),
timestamp.encode() + b"." + raw_body,
hashlib.sha256,
).hexdigest()
Verification requirements
- Use the exact raw body bytes; do not parse and serialize JSON again.
- Reject timestamps that differ by more than five minutes.
- Compare signatures in constant time.
- Verify before parsing or processing business data.
- Callbacks and inbound requests use the same secret and algorithm.