Signer
¶ Connector
apps/baileys-connector/src/internal/api-client.ts
Security
¶ HMAC Internal API
Connector callbacks to the API are signed with HMAC-SHA256. The API only accepts a callback whose signature it can recompute with the shared secret.
HMAC-SHA256
Connector → API
INTERNAL_HMAC_SECRET
No parallel transport
Signing flow
¶ Signed by the connector, verified by the API
X-Replybox-Timestampts
X-Replybox-SignatureHMAC-SHA256
Verifier
¶ API
apps/api/app/security/hmac.py
What gets signed
¶ Four parts, joined by newlines
Connector callbacks use HMAC-SHA256 over the timestamp, the HTTP method, the request path, and the body.
1
{ts}
2{METHOD}
3{path}
4{body}
String to sign
Headers the connector sends{ts}\n{METHOD}\n{path}\n{body}X-Replybox-Timestamp and X-Replybox-Signature
Rules
¶ Keep one connector-to-API path
DoExtend this path for connector-to-API communication.
Do notAdd a parallel transport.
Getting HMAC 401s? The API and connector must hold the same INTERNAL_HMAC_SECRET; a mismatch shows up as rejected callbacks. See shared secrets.
Not the public webhook signature. This internal scheme signs {ts}\n{METHOD}\n{path}\n{body}. Public webhooks that ReplyBox sends to customers use a different signed string; see Webhook signatures.