Webhook signatures

Auth: Webhook signing secret (rk_whsec_)

rokochat delivers events via POST to your registered URL. Each request includes a Rokochat-Signature header. Verify the raw request body — not re-parsed JSON. Replay tolerance is 300 seconds. Retries: 10s, 1m, 5m, 30m, 2h, 6h.

Header parameters

Name	Type	Description
`Rokochat-Signature`required	`string`	t=UNIX_TIMESTAMP,v1=HEX_HMAC

Responses

200Acknowledge receipt with any 2xx

# Signed string: "{timestamp}.{raw_json_body}"
# HMAC-SHA256 with rk_whsec_... signing secret

import hmac, hashlib, os

def verify(payload: bytes, header: str, secret: str) -> bool:
    t, sig = header.split(",")
    timestamp = t.split("=")[1]
    expected = hmac.new(
        secret.encode(), f"{timestamp}.{payload.decode()}".encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"v1={expected}", sig)