Async

HMAC callbacks

Async runs can notify your backend when they finish. Every callback is signed — verify before you trust status, output, or receipts.

Verify the signature

Header X-Agenticaria-Signature is hex(HMAC-SHA256(body, secret)). Use a constant-time compare.

import crypto from "node:crypto";

function verify(body, secret, header) {
  const dig = crypto.createHmac("sha256", secret)
    .update(body).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(dig), Buffer.from(header)
  );
}