zerohash-webhooks

Zero Hash Webhooks

When to Use This Skill

• How do I receive Zero Hash webhooks?
• How do I verify Zero Hash webhook signatures (x-zh-hook-signature)?
• How do I handle trade_status_changed and payment_status_changed events?
• Why is my Zero Hash webhook signature verification failing?
• How do I guard Zero Hash webhooks against replay attacks with x-zh-hook-timestamp?

Verification (core)

Zero Hash signs the raw request body with HMAC-SHA256 and sends the digest as a hex string. There is no webhook SDK — verify manually.

The recommended (replay-protected) scheme signs payload + timestamp (concatenated raw strings, no delimiter) and sends:

• x-zh-hook-signature — to_hex(hmac_sha256(payload + timestamp, secret))
• x-zh-hook-timestamp — the UNIX timestamp that was signed

Reject the request if the timestamp is not within ±5 minutes of your clock, then compare the signature timing-safe. Zero Hash documents the ±5 minute window but not whether the timestamp is in seconds or milliseconds, so normalize the value before comparing rather than assuming a unit:

const crypto = require('crypto');

// The unit of x-zh-hook-timestamp is not documented. A ~10-digit value is
// seconds, a ~13-digit value is milliseconds — normalize to ms either way.
function toMillis(timestamp) {
  const value = Number(timestamp);
  if (!Number.isFinite(value)) return NaN;
  return Math.abs(value) < 1e11 ? value * 1000 : value;
}

function verifyZeroHash(rawBody, signature, timestamp, secret, toleranceMs = 5 * 60 * 1000) {
  if (!signature || !timestamp) return false;
  // Replay guard: accept either seconds or milliseconds.
  const timestampMs = toMillis(timestamp);
  if (!Number.isFinite(timestampMs)) return false;
  if (Math.abs(Date.now() - timestampMs) > toleranceMs) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody + timestamp, 'utf8') // payload + timestamp, no delimiter
    .digest('hex');
  try {
    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
  } catch {
    return false; // length mismatch => invalid
  }
}