Skip to main content
The AlgoVoi gateway signs every outbound webhook with an X-AlgoVoi-Signature header containing a UNIX timestamp and two HMAC components. algovoi-webhook-verifier validates the header, enforces replay protection, and returns the parsed event — with no runtime dependency on AlgoVoi infrastructure.

Verification steps

The v2 component uses HKDF-SHA256 key derivation with salt=b"algovoi-webhook-v2-pqc" and info=b"hmac-sha384-outbound", length 48 bytes.

Quick start


Framework integration


Error codes


API reference

Python

Raises WebhookVerificationError(code, message) on any failure. .code is one of the six ErrorCode literals. .message is a human-readable description.

TypeScript

Throws WebhookVerificationError with .code (typed ErrorCode) and .message.

Webhook event shape


Supported event types

Additional event types will be added in future versions with full vector coverage.

Cross-validation vectors

13 fixtures in vectors/valid/ (5) and vectors/invalid/ (8). Each vector is self-contained — it embeds the secret, raw body, and header so any language implementation can verify itself against the same corpus. Regenerate all vectors:

Test results

Python 47/47 · TypeScript 45/45

8-language cross-validation

104/104 agreements — all 8 language implementations produce byte-for-byte identical HMAC results and identical error-code verdicts across all 13 vectors. Attestation and reproduction commands: _attestations/2026-05-31-8-impl-cross-validation.md

See also