Vote webhook

HMAC SHA-256 signed POST, replay protection, timestamp in the body.

On every vote, CGS Hub POSTs your configured URL (Settings).

Headers

POST <your URL>
Content-Type: application/json
X-CgsHubs-Signature: sha256=<hmac_sha256(secret, raw body)>

The signature covers the raw body. The timestamp lives inside the signed JSON: no separate clock header.

Body

{
  "type": "vote",
  "id": "3f2a…",
  "server": "my-server",
  "playername": "Pseudo",
  "votedAt": "2026-09-06T18:24:11.000Z",
  "timestamp": 1788719051000
}

id: UUID, replay key. playername may be null. timestamp: ms epoch, ± 5 min freshness window.

Verify (Lua)

local expected = exports.crypto:hmac_sha256(secret, rawBody)
if ("sha256=" .. expected) ~= headers["X-CgsHubs-Signature"] then return end

Reject a seen id and a timestamp that is too old or too far in the future. Transport: HTTPS only.