Build on custody primitives, not around them.

import crypto from 'node:crypto';

// Your API user's Ed25519 private key (PEM). It never leaves your system.
const key = crypto.createPrivateKey(process.env.OPTITOR_API_KEY);

// Form-encode like Go's url.QueryEscape: spaces become '+'.
const esc = (s) =>
  encodeURIComponent(s)
    .replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase())
    .replace(/%20/g, '+');

export function signedHeaders(method, path, query = {}, body = '') {
  const qs = Object.keys(query)
    .sort()
    .map((k) => esc(k) + '=' + esc(String(query[k])))
    .join('&');
  const timestamp = String(Math.floor(Date.now() / 1000));
  const nonce = crypto.randomUUID();
  const canonical = [
    'optitor-v1',
    method,
    qs ? path + '?' + qs : path,
    crypto.createHash('sha256').update(body).digest('hex'),
    timestamp,
    nonce,
  ].join('\n');
  const signature = crypto.sign(null, Buffer.from(canonical), key);
  return {
    'X-Auth-Timestamp': timestamp,
    'X-Auth-Nonce': nonce,
    'X-Auth-Signature': signature.toString('base64'),
  };
}

import crypto from 'node:crypto';

// X-Optitor-Signature: t=<unix seconds>,v1=<hex>[,v1=<hex>]
// Two v1 values are sent while a secret rotation overlaps.
export function verifyWebhook(rawBody, header, secret, tolerance = 300) {
  const pairs = header.split(',').map((p) => p.trim().split('='));
  const t = Number(pairs.find(([k]) => k === 't')?.[1]);
  const now = Date.now() / 1000;
  if (!Number.isFinite(t) || Math.abs(now - t) > tolerance) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(t + '.' + rawBody)
    .digest();
  return pairs
    .filter(([k]) => k === 'v1')
    .some(([, hex]) => {
      const got = Buffer.from(hex, 'hex');
      return got.length === expected.length &&
        crypto.timingSafeEqual(got, expected);
    });
}

→ { "type": "subscribe", "topics": ["deposits", "approvals", "tx:f0b7…"] }
← { "type": "subscribed", "topics": ["deposits", "approvals", "tx:f0b7…"] }
← { "type": "event", "topic": "tx:f0b7…", "event": "transaction.approved",
    "data": { "id": "f0b7…", "status": "approved", "currentApprovals": 3 } }