An API you can build a business on.

{
  "specversion": "1.0",
  "id": "01a10b01-62e9-737e-8f5b-f16c3ed1ef81",
  "type": "com.biller.billing.invoice.finalized.v1",
  "source": "https://api.biller.example/tenants/01a10b01-032f-70be-9a73-460a06da1b18",
  "subject": "invoices/01a10b01-62b8-71fb-b218-faaa510fcf97",
  "time": "2026-09-25T14:00:00.000Z",
  "datacontenttype": "application/json",
  "tenantid": "01a10b01-032f-70be-9a73-460a06da1b18",
  "environment": "test",
  "aggregateversion": 4,
  "data": {
    "id": "01a10b01-62b8-71fb-b218-faaa510fcf97",
    "number": "INV-000020",
    "status": "open",
    "currency": "CAD",
    "total_minor": 551,
    "amount_due_minor": 551,
    "due_date": "2026-10-02"
  }
}

import { createHmac, timingSafeEqual } from 'node:crypto';

/** Biller-Signature: t=<unix>,v1=<hex>[,v1=<hex> during a rotation] */
export function verify(header: string, body: string, secret: string, tolerance = 300) {
  const parts = header.split(',').map((part) => part.trim().split('=', 2));
  const t = Number(parts.find(([key]) => key === 't')?.[1]);
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > tolerance) return false;

  const expected = createHmac('sha256', secret).update(`${t}.${body}`).digest();
  return parts
    .filter(([key]) => key === 'v1')
    .some(([, hex = '']) => {
      const given = Buffer.from(hex, 'hex');
      return given.length === expected.length && timingSafeEqual(given, expected);
    });
}

function verifyBillerSignature(string $header, string $body, string $secret, int $tolerance = 300): bool
{
    $timestamp = null;
    $signatures = [];

    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, '');
        if ($key === 't' && ctype_digit($value)) {
            $timestamp = (int) $value;
        } elseif ($key === 'v1') {
            $signatures[] = $value;
        }
    }

    if ($timestamp === null || abs(time() - $timestamp) > $tolerance) {
        return false;
    }

    $expected = hash_hmac('sha256', $timestamp.'.'.$body, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }

    return false;
}