Signature verification

To improve the communication security between the Agora Notification Callback Server ( server and your server, Agora uses signatures for identity verification. The following steps show how to verify a signature:

When you configure the Agora NCS, Agora generates a secret. You need to obtain the secret from Agora technical support and save it for signature verification when activating the NCS.
When sending a message notification callback to your server, the Agora NCS server generates two signature values by using a secret and the HMAC/SHA1 and HMAC/SHA256 algorithms, and then adds the signature values to the Agora-Signature and Agora-Signature-V2 fields of the HTTPS request header.
After receiving the notification callback, you can verify either Agora-Signature or Agora-Signature-V2. To verify Agora-Signature, use the secret, the raw request body, and the HMAC/SHA1 algorithm; to verify Agora-Signature-V2, use the secret, the raw request body, and the HMAC/SHA2 algorithm.

You can refer to the following signature verification code samples:

Python

HMAC/SHA256

#!/usr/bin/env python2
# !-*- coding: utf-8 -*-
import hashlib
import hmac
# Gets the raw request body of the message notification and calculate the signature. The request_body in the following code is a binary byte array before deserialization and not a dictionary after deserialization.
request_body = '{"eventMs":1560408533119,"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'
secret = 'secret'
signature2 = hmac.new(secret, request_body, hashlib.sha256).hexdigest()
print(signature2) # 6d3320c60b11101395b7fc8f9068748808a0aa1bfa064438e39d1bc2c7d74d99</code></pre>

HMAC/SHA1

#!/usr/bin/env python2
# !-*- coding: utf-8 -*-
import hashlib
import hmac
# Gets the raw request body of the message notification and calculate the signature. The request_body in the following code is a binary byte array before deserialization and not a dictionary after deserialization.
request_body = '{"eventMs":1560408533119,"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'
secret = 'secret'
signature = hmac.new(secret, request_body, hashlib.sha1).hexdigest()
print(signature) # 033c62f40f687675f17f0f41f91a40c71c0f134c</code></pre>

Node.js

HMAC/SHA256

const crypto = require('crypto')
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
const requestBody = '{"eventMs":1560408533119,"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'  
const secret = 'secret'   
const signature2 = crypto.createHmac('sha256', secret).update(requestBody, 'utf8').digest('hex')
console.log(signature2) // 6d3320c60b11101395b7fc8f9068748808a0aa1bfa064438e39d1bc2c7d74d99
</code></pre>

HMAC/SHA1

const crypto = require('crypto')
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
const requestBody = '{"eventMs":1560408533119,"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}'  
const secret = 'secret'  
const signature = crypto.createHmac('sha1', secret).update(requestBody, 'utf8').digest('hex')  
console.log(signature) // 033c62f40f687675f17f0f41f91a40c71c0f134c

Java

HMAC/SHA256

import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
public class HmacSha {
    // Converts an encrypted byte array into a hex string
    public static String bytesToHex(byte[] bytes) {
        StringBuffer sb = new StringBuffer();
        for (int i = 0; i &lt; bytes.length; i++) {
            String hex = Integer.toHexString(bytes[i] &amp; 0xFF);
            if (hex.length() &lt; 2) {
                sb.append(0);
            }
            sb.append(hex);
        }
        return sb.toString();
    }
    // Gets the encrypted hex string using the HMAC/SHA256 algorithm
    public static String hmacSha256(String message, String secret) {
        try {
            SecretKeySpec signingKey = new SecretKeySpec(secret.getBytes(
                    "utf-8"), "HmacSHA256");
            Mac mac = Mac.getInstance("HmacSHA256");
            mac.init(signingKey);
            byte[] rawHmac = mac.doFinal(message.getBytes("utf-8"));
            return bytesToHex(rawHmac);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    public static void main(String[] args) {
        // Gets the raw request body of the message notification and calculate the
        // signature. The request_body in the following code is a binary byte array
        // before deserialization and not an object after deserialization.
        String request_body = "{\"eventMs\":1560408533119,\"eventType\":10,\"noticeId\":\"4eb720f0-8da7-11e9-a43e-53f411c2761f\",\"notifyMs\":1560408533119,\"payload\":{\"a\":\"1\",\"b\":2},\"productId\":1}";
        String secret = "secret";
        System.out.println(hmacSha256(request_body, secret)); // 033c62f40f687675f17f0f41f91a40c71c0f134c
    }
}

HMAC/SHA1

import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
public class HmacSha {
    // Converts an encrypted byte array into a hex string
    public static String bytesToHex(byte[] bytes) {
        StringBuffer sb = new StringBuffer();
        for (int i = 0; i &lt; bytes.length; i++) {
            String hex = Integer.toHexString(bytes[i] &amp; 0xFF);
            if (hex.length() &lt; 2) {
                sb.append(0);
            }
            sb.append(hex);
        }
        return sb.toString();
    }
    // Gets the encrypted hex string using the HMAC/SHA1 algorithm
    public static String hmacSha1(String message, String secret) {
        try {
            SecretKeySpec signingKey = new SecretKeySpec(secret.getBytes(
                    "utf-8"), "HmacSHA1");
            Mac mac = Mac.getInstance("HmacSHA1");
            mac.init(signingKey);
            byte[] rawHmac = mac.doFinal(message.getBytes("utf-8"));
            return bytesToHex(rawHmac);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    public static void main(String[] args) {
        // Gets the raw request body of the message notification and calculate the
        // signature. The request_body in the following code is a binary byte array
        // before deserialization and not an object after deserialization.
        String request_body = "{\"eventMs\":1560408533119,\"eventType\":10,\"noticeId\":\"4eb720f0-8da7-11e9-a43e-53f411c2761f\",\"notifyMs\":1560408533119,\"payload\":{\"a\":\"1\",\"b\":2},\"productId\":1}";
        String secret = "secret";
        System.out.println(hmacSha1(request_body, secret)); // 033c62f40f687675f17f0f41f91a40c71c0f134c
    }
}

PHP

HMAC/SHA256

&lt;?php
function assertEqual($expect, $actual)
{
    if ($expect != $actual) {
        echo("\n assert failed");
        echo("\n  expect:\n    " . $expect);
        echo("\n  actual:\n    " . $actual);
        echo("\n");
    } else {
        echo("assert ok\n");
        echo("\n");
    }
}
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
$request_body = '{"eventMs":1560408533119,"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}';
$secret = 'secret';
// The value of Agora-Signature-V2 in the request header
$sha256 = '6d3320c60b11101395b7fc8f9068748808a0aa1bfa064438e39d1bc2c7d74d99';
$res2 = (hash_hmac('sha256', $request_body, $secret));
assertEqual($res2, $sha256);
?>

HMAC/SHA1

&lt;?php
function assertEqual($expect, $actual)
{
    if ($expect != $actual) {
        echo("\n assert failed");
        echo("\n  expect:\n    " . $expect);
        echo("\n  actual:\n    " . $actual);
        echo("\n");
    } else {
        echo("assert ok\n");
        echo("\n");
    }
}
// Gets the raw request body of the message notification and calculate the signature. The requestBody in the following code is a binary byte array before deserialization and not an object after deserialization.
$request_body = '{"eventMs":1560408533119,"eventType":10,"noticeId":"4eb720f0-8da7-11e9-a43e-53f411c2761f","notifyMs":1560408533119,"payload":{"a":"1","b":2},"productId":1}';
$secret = 'secret';
// The value of Agora-Signature in the request header
$sha1 = '033c62f40f687675f17f0f41f91a40c71c0f134c';  
$res1 = (hash_hmac('sha1', $request_body, $secret));
assertEqual($res1, $sha1);
?>