inmake DOCS
Docs / SDK / Secure

Secure

Token and secret management; verifying inbound hooks.

Secure (DropCoreSecure)#

src/secure/drop_core_secure.ts. Routes at secure/**, role-gated: only master / owner can mint tokens, and only master can mint another master. A token minted without an explicit role defaults to service.

Property Notes
access Token lifecycle — create(options), list(), update(id, options), remove(id), reveal(id), plus mintIdentity(user, { access_token?, note?, meta?, origins? }) / updateIdentity(token, { note?, meta?, origins? }) for customer-scoped identity tokens (origin-fenced, cascade-revoked with their parent).
secret Encrypted-at-rest store secrets (AES, admin-eur3-backed).
expose / revoke Publish / withdraw a credential; revoke.identity cascades.
syncStore Cross-project (prod ↔ demo) store sync — needs CROSS_PROJECT_SA server-side.

Verifying inbound data hooks (verifyHookSeed)#

src/secure/hook_seed.ts (re-exported from the root) is the receiver-side counterpart of the backend's outbound data hooks: when a store hook carries a private key, every push arrives with an access_seed: <ts>.<signature> header, where signature = HMAC-SHA256(ts, privateKey) — or, for a label-bound seed, HMAC-SHA256("<ts>.<label>", privateKey). The signature covers the timestamp (+ optional label) only, never the request body.

  • verifyHookSeed(seed, privateKey, options?) — true only when the signature matches (and the timestamp is within maxAgeMs, when given). Never throws on malformed input.
  • verifyHookSeedReason(...) — reason-bearing form: distinguishes 'bad_signature' / 'bad_format' from an authentic-but-out-of-window 'stale' / 'future' (replay or clock drift — see VerifySeedOptions.clockSkewMs).
  • options.label binds verification to a per-push label — the backend signs data pushes with {locale}/{collection}/{id} and order/invoice pushes with orders/{id} / invoices/{id}, so a captured seed can't be replayed against another document. options.acceptUnbound (default true) also accepts an authentic seed signed without the label — the migration path; set false once the backend signer always binds.

Signing is backend-only — the SDK intentionally exposes no seed generator. Node-only (crypto); drop-core-server's HookReceiver builds on this.