Authentication & Security

# Authentication & Security

All requests to the NotifySetu API must be authenticated over TLS 1.3 using HTTP Bearer Tokens.

Bearer Token Header

Include your API key in the `Authorization` header of every HTTP request:

Authorization: Bearer nts_live_your_api_key_here

If an API key is invalid or revoked, the API responds with a `401 Unauthorized` JSON payload:

{
  "error": "UNAUTHORIZED",
  "message": "Invalid API key or missing Bearer authorization token."
}

Webhook HMAC Verification

To verify that incoming webhook payloads originate from NotifySetu, compute an HMAC-SHA256 signature using your Webhook Signing Secret.

import crypto from "crypto";

function verifyWebhookSignature(payload, signatureHeader, secret) { const hmac = crypto.createHmac("sha256", secret); const digest = "sha256=" + hmac.update(payload).digest("hex"); return crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(signatureHeader)); } ```