Verify signature - rhino.fi - Docs

As your endpoint is public, anyone can send it some data. For you to make sure the data is coming from Rhino.fi, you’ll receive a signature in the request header, called X-Rhino-Signature. To verify the signature you have 2 options:

Using the SDK
Manual verification

SDK

To verify the signature received using the SDK, you can do the following:

const isValid = await sdk.api.webhook.verifySignature(receivedEventBody, signature)

Under the hood it will fetch the Rhino.fi webhook public key and verify the data provided was signed by Rhino.fi.

Manual verification

Manually verifying the received signature is a two step process. You first need to fetch Rhino.fi webhook public key and then use it to verify the signature. This can be done with the following function:

import { createHash, createVerify } from 'crypto'

const isSignatureValid = async (receivedEventBody, signature) => {
  // Fetch Rhino.fi webhook public key
  const res = await fetch('https://api.rhino.fi/webhook/public-key')
  const publicKeyBase64 = await res.json()
  const publicKey = Buffer.from(publicKeyBase64, 'base64').toString()  

  // Hash the stringified event
  const hash = createHash('sha256')
  const hashedMessage = hash.update(
    JSON.stringify(receivedEventBody),
  )

  // Verify the signature
  const verify = createVerify('RSA-SHA256')
  verify.update(hashedMessage.digest('hex'))
  return verify.verify(publicKey, signature, 'hex') 
}

⌘I