Signature Verification

Last updated 2022/10/12 03:00:39

To improve the communication security between the Agora Notification Callback Server ( server and your server, Agora uses signatures for identity verification. The following steps show how to verify a signature:

When you configure the Agora NCS, Agora generates a secret. You need to obtain the secret from Agora technical support and save it for signature verification when activating the NCS.
When sending a message notification callback to your server, the Agora NCS server generates two signature values by using a secret and the HMAC/SHA1 and HMAC/SHA256 algorithms, and then adds the signature values to the Agora-Signature and Agora-Signature-V2 fields of the HTTPS request header.
After receiving the notification callback, you can verify either Agora-Signature or Agora-Signature-V2. To verify Agora-Signature, use the secret, the raw request body, and the HMAC/SHA1 algorithm; to verify Agora-Signature-V2, use the secret, the raw request body, and the HMAC/SHA2 algorithm.

You can refer to the following signature verification code samples:

Python

HMAC/SHA256

HMAC/SHA1

#!/usr/bin/env python2
# !-*- coding: utf-8 -*-
import hashlib
import hmac
# Gets the raw request body of the message notification and calculate the signature. The request_body in the following code is a binary byte array before deserialization and not a dictionary after deserialization.
request_body = '{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'
secret = 'secret'
signature2 = hmac.new(secret, request_body, hashlib.sha256).hexdigest()
print(signature2) # 6d3320c60b11101395b7fc8f9068748808a0aa1bfa064438e39d1bc2c7d74d99

#!/usr/bin/env python2
# !-*- coding: utf-8 -*-
import hashlib
import hmac
# Gets the raw request body of the message notification and calculate the signature. The request_body in the following code is a binary byte array before deserialization and not a dictionary after deserialization.
request_body = '{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'
secret = 'secret'
signature = hmac.new(secret, request_body, hashlib.sha1).hexdigest()
print(signature) # 033c62f40f687675f17f0f41f91a40c71c0f134c

Node.js

HMAC/SHA256

HMAC/SHA1

const crypto = require('crypto')
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
const requestBody = '{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'  
const secret = 'secret'   
const signature2 = crypto.createHmac('sha256', secret).update(requestBody, 'utf8').digest('hex')
console.log(signature2) // 6d3320c60b11101395b7fc8f9068748808a0aa1bfa064438e39d1bc2c7d74d99

const crypto = require('crypto')
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
const requestBody = '{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'  
const secret = 'secret'  
const signature = crypto.createHmac('sha1', secret).update(requestBody, 'utf8').digest('hex')  
console.log(signature) // 033c62f40f687675f17f0f41f91a40c71c0f134c

Java

HMAC/SHA256

HMAC/SHA1

import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
public class HmacSha {
    // Converts an encrypted byte array into a hex string
    public static String bytesToHex(byte[] bytes) {
        StringBuffer sb = new StringBuffer();
        for (int i = 0; i < bytes.length; i++) {
            String hex = Integer.toHexString(bytes[i] & 0xFF);
            if (hex.length() < 2) {
                sb.append(0);
            }
            sb.append(hex);
        }
        return sb.toString();
    }
    // Gets the encrypted hex string using the HMAC/SHA256 algorithm
    public static String hmacSha256(String message, String secret) {
        try {
            SecretKeySpec signingKey = new SecretKeySpec(secret.getBytes(
                    "utf-8"), "HmacSHA256");
            Mac mac = Mac.getInstance("HmacSHA256");
            mac.init(signingKey);
            byte[] rawHmac = mac.doFinal(message.getBytes("utf-8"));
            return bytesToHex(rawHmac);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    public static void main(String[] args) {
        // Gets the raw request body of the message notification and calculate the
        // signature. The request_body in the following code is a binary byte array
        // before deserialization and not an object after deserialization.
        String request_body = "{\"eventType\":10,\"noticeId\":\"4eb720f0-8da7-11e9-a43e-53f411c2761f\",\"notifyMs\":1560408533119,\"payload\":{\"a\":\"1\",\"b\":2},\"productId\":1}";
        String secret = "secret";
        System.out.println(hmacSha256(request_body, secret)); // 033c62f40f687675f17f0f41f91a40c71c0f134c
    }
}

import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
public class HmacSha {
    // Converts an encrypted byte array into a hex string
    public static String bytesToHex(byte[] bytes) {
        StringBuffer sb = new StringBuffer();
        for (int i = 0; i < bytes.length; i++) {
            String hex = Integer.toHexString(bytes[i] & 0xFF);
            if (hex.length() < 2) {
                sb.append(0);
            }
            sb.append(hex);
        }
        return sb.toString();
    }
    // Gets the encrypted hex string using the HMAC/SHA1 algorithm
    public static String hmacSha1(String message, String secret) {
        try {
            SecretKeySpec signingKey = new SecretKeySpec(secret.getBytes(
                    "utf-8"), "HmacSHA1");
            Mac mac = Mac.getInstance("HmacSHA1");
            mac.init(signingKey);
            byte[] rawHmac = mac.doFinal(message.getBytes("utf-8"));
            return bytesToHex(rawHmac);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    public static void main(String[] args) {
        // Gets the raw request body of the message notification and calculate the
        // signature. The request_body in the following code is a binary byte array
        // before deserialization and not an object after deserialization.
        String request_body = "{\"eventType\":10,\"noticeId\":\"4eb720f0-8da7-11e9-a43e-53f411c2761f\",\"notifyMs\":1560408533119,\"payload\":{\"a\":\"1\",\"b\":2},\"productId\":1}";
        String secret = "secret";
        System.out.println(hmacSha1(request_body, secret)); // 033c62f40f687675f17f0f41f91a40c71c0f134c
    }
}

PHP

HMAC/SHA256

HMAC/SHA1

<?php
function assertEqual($expect, $actual)
{
    if ($expect != $actual) {
        echo("\n assert failed");
        echo("\n  expect:\n    " . $expect);
        echo("\n  actual:\n    " . $actual);
        echo("\n");
    } else {
        echo("assert ok\n");
        echo("\n");
    }
}
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
$request_body = '{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}';
$secret = 'secret';
// The value of Agora-Signature-V2 in the request header
$sha256 = '6d3320c60b11101395b7fc8f9068748808a0aa1bfa064438e39d1bc2c7d74d99';
$res2 = (hash_hmac('sha256', $request_body, $secret));
assertEqual($res2, $sha256);
?>

<?php
function assertEqual($expect, $actual)
{
    if ($expect != $actual) {
        echo("\n assert failed");
        echo("\n  expect:\n    " . $expect);
        echo("\n  actual:\n    " . $actual);
        echo("\n");
    } else {
        echo("assert ok\n");
        echo("\n");
    }
}
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
$request_body = '{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}';
$secret = 'secret';
// The value of Agora-Signature in the request header
$sha1 = '033c62f40f687675f17f0f41f91a40c71c0f134c';  
$res1 = (hash_hmac('sha1', $request_body, $secret));
assertEqual($res1, $sha1);
?>

Go

HMAC/SHA256

HMAC/SHA1

package main
import (
  "crypto/hmac"
  "crypto/sha256"
  "encoding/hex"
  "fmt"
)
func main() {
  // Gets the raw request body of the message notification and calculate the signature. The request_body in the following code is a binary byte array before deserialization and not a dictionary after deserialization.
  request_body := `{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}`
  secret := "secret"
  fmt.Println(calcSignatureV2(secret, request_body)) // 6d3320c60b11101395b7fc8f9068748808a0aa1bfa064438e39d1bc2c7d74d99
}
func calcSignatureV2(secret, payload string) string {
  mac := hmac.New(sha256.New, []byte(secret))
  mac.Write([]byte(payload))
  return hex.EncodeToString(mac.Sum(nil))
}

package main
import (
  "crypto/hmac"
  "crypto/sha1"
  "encoding/hex"
  "fmt"
)
func main() {
  // Gets the raw request body of the message notification and calculate the signature. The request_body in the following code is a binary byte array before deserialization and not a dictionary after deserialization.
  request_body := `{"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}`
  secret := "secret"
  fmt.Println(calcSignatureV1(secret, request_body))  // 033c62f40f687675f17f0f41f91a40c71c0f134c
}
func calcSignatureV1(secret, payload string) string {
  mac := hmac.New(sha1.New, []byte(secret))
  mac.Write([]byte(payload))
  return hex.EncodeToString(mac.Sum(nil))
}

Is this page helpful?

Yes