X-AlgoVoi-Signature header containing a UNIX timestamp and two HMAC components. algovoi-webhook-verifier validates the header, enforces replay protection, and returns the parsed event — with no runtime dependency on AlgoVoi infrastructure.
Verification steps
The v2 component uses HKDF-SHA256 key derivation with
salt=b"algovoi-webhook-v2-pqc" and info=b"hmac-sha384-outbound", length 48 bytes.
Quick start
Framework integration
Error codes
API reference
Python
WebhookVerificationError(code, message) on any failure. .code is one of the six ErrorCode literals. .message is a human-readable description.
TypeScript
WebhookVerificationError with .code (typed ErrorCode) and .message.
Webhook event shape
Supported event types
Additional event types will be added in future versions with full vector coverage.
Cross-validation vectors
13 fixtures invectors/valid/ (5) and vectors/invalid/ (8). Each vector is self-contained — it embeds the secret, raw body, and header so any language implementation can verify itself against the same corpus.
Regenerate all vectors:
Test results
Python 47/47 · TypeScript 45/45
8-language cross-validation
104/104 agreements — all 8 language implementations produce byte-for-byte identical HMAC results and identical error-code verdicts across all 13 vectors.
Attestation and reproduction commands:
_attestations/2026-05-31-8-impl-cross-validation.md
See also
- Notifications — webhook delivery, retry schedule, and secret rotation
- Compliance receipt verifier — JWS compliance receipt verification
- Audit verifier — offline audit bundle verification
- Package suite — full open-source package listing