API Keys Overview

const crypto = require('crypto');

function signStashRequest(appId, body, ingressSecretB64) {
  const unixMs = Date.now().toString();
  // base64-decode the ingress secret from Studio → Project Settings → API Secrets
  const key = Buffer.from(ingressSecretB64, 'base64');
  const sig = crypto
    .createHmac('sha256', key)
    .update(`${unixMs}.${body}`)
    .digest('base64');
  return `v1;${appId};${unixMs};${sig}`;
}

// Set as x-stash-hmac-signature header value:
const headerValue = signStashRequest(
  process.env.APP_ID,           // App ID from Studio → Project Settings → App details
  JSON.stringify(requestBody),  // exact bytes you will POST (sign what you send)
  process.env.INGRESS_SECRET    // base64-encoded ingress secret from Studio → Project Settings → API Secrets
);

import base64
import hashlib
import hmac
import json
import os
import time

def sign_stash_request(app_id, body, ingress_secret_b64):
    unix_ms = str(int(time.time() * 1000))
    # base64-decode the ingress secret from Studio → Project Settings → API Secrets
    key = base64.b64decode(ingress_secret_b64)
    signed_msg = f"{unix_ms}.{body}"
    sig = base64.b64encode(
        hmac.new(key, signed_msg.encode('utf-8'), hashlib.sha256).digest()
    ).decode('utf-8')
    return f"v1;{app_id};{unix_ms};{sig}"

# Set as x-stash-hmac-signature header value:
header_value = sign_stash_request(
    os.environ['APP_ID'],           # App ID from Studio → Project Settings → App details
    json.dumps(request_body),       # exact bytes you will POST (sign what you send)
    os.environ['INGRESS_SECRET']    # base64-encoded ingress secret from Studio → Project Settings → API Secrets
)

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"os"
	"strconv"
	"time"
)

func signStashRequest(appID, body, ingressSecretB64 string) (string, error) {
	unixMs := strconv.FormatInt(time.Now().UnixMilli(), 10)
	// base64-decode the ingress secret from Studio → Project Settings → API Secrets
	key, err := base64.StdEncoding.DecodeString(ingressSecretB64)
	if err != nil {
		return "", err
	}
	signedMsg := fmt.Sprintf("%s.%s", unixMs, body)
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(signedMsg))
	sig := base64.StdEncoding.EncodeToString(mac.Sum(nil))
	return fmt.Sprintf("v1;%s;%s;%s", appID, unixMs, sig), nil
}

// Set as x-stash-hmac-signature header value:
headerValue, err := signStashRequest(
	os.Getenv("APP_ID"),          // App ID from Studio → Project Settings → App details
	string(requestBodyBytes),     // exact bytes you will POST (sign what you send)
	os.Getenv("INGRESS_SECRET"),  // base64-encoded ingress secret from Studio → Project Settings → API Secrets
)

const crypto = require('crypto');

function verifyStashSignature(headerValue, body, egressSecretB64) {
  const [version, appId, unixMs, receivedSig] = headerValue.split(';');

  // Reject requests outside the 5-minute clock-skew window
  if (Math.abs(Date.now() - Number(unixMs)) > 5 * 60 * 1000) return false;

  // base64-decode the egress key from Studio → Project Settings → API Secrets
  const key = Buffer.from(egressSecretB64, 'base64');
  // body is empty string for GET requests; raw bytes for POST
  const signedMsg = `${unixMs}.${body}`;

  const expected = crypto
    .createHmac('sha256', key)
    .update(signedMsg)
    .digest('base64');

  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(receivedSig));
}

import base64
import hashlib
import hmac
import time

def verify_stash_signature(header_value, body, egress_secret_b64):
    parts = header_value.split(';', 3)
    version, app_id, unix_ms, received_sig = parts[0], parts[1], parts[2], parts[3]

    # Reject requests outside the 5-minute clock-skew window
    if abs(time.time() * 1000 - int(unix_ms)) > 5 * 60 * 1000:
        return False

    # base64-decode the egress key from Studio → Project Settings → API Secrets
    key = base64.b64decode(egress_secret_b64)
    # body is empty string for GET requests
    signed_msg = f"{unix_ms}.{body}"

    expected = base64.b64encode(
        hmac.new(key, signed_msg.encode('utf-8'), hashlib.sha256).digest()
    ).decode('utf-8')

    return hmac.compare_digest(expected, received_sig)

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"math"
	"strconv"
	"strings"
	"time"
)

func verifyStashSignature(headerValue string, body []byte, egressSecretB64 string) bool {
	parts := strings.SplitN(headerValue, ";", 4)
	if len(parts) != 4 {
		return false
	}
	unixMs, receivedSig := parts[2], parts[3]

	// Reject requests outside the 5-minute clock-skew window
	ts, err := strconv.ParseInt(unixMs, 10, 64)
	if err != nil || math.Abs(float64(time.Now().UnixMilli()-ts)) > 5*60*1000 {
		return false
	}

	// base64-decode the egress key from Studio → Project Settings → API Secrets
	key, err := base64.StdEncoding.DecodeString(egressSecretB64)
	if err != nil {
		return false
	}

	// body is empty for GET requests
	signedMsg := fmt.Sprintf("%s.%s", unixMs, body)
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(signedMsg))
	expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))

	return hmac.Equal([]byte(expected), []byte(receivedSig))
}