Verify Signature

Last 30 days

Uptime

71.4%

Response time

284 ms typical, 320 ms slowest 5%

Last check

4 h ago

Next check

any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X POST "https://api.ibancheck.co.uk/api/verify-signature" \
  -H "content-type: application/json" \
  -d '{"hmacSignature":"<hmacSignature from sign-transaction>","payload":{"amount":150,"orderId":"A-1001"},"sha256":"<sha256 from sign-transaction>","timestampMs":1791301906606}'

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fapi.ibancheck.co.uk%2Fapi%2Fverify-signature
const res = await pay("https://api.ibancheck.co.uk/api/verify-signature", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"hmacSignature":"<hmacSignature from sign-transaction>","payload":{"amount":150,"orderId":"A-1001"},"sha256":"<sha256 from sign-transaction>","timestampMs":1791301906606}),
});
console.log(await res.json());

Example input

{
  "hmacSignature": "<hmacSignature from sign-transaction>",
  "payload": {
    "amount": 150,
    "orderId": "A-1001"
  },
  "sha256": "<sha256 from sign-transaction>",
  "timestampMs": 1791301906606
}

Example output

{
  "errors": [],
  "hmacValid": true,
  "isValid": true,
  "providedSha256": "70247945ceeacd1bc929d1612cfcc36b0c0c4803e1350505c875b28a036015ca",
  "recomputedMerkleLeaf": "fabe21766a6cd66686e58bb4c4996cc9c322017a4c7b87898500ec860d618407",
  "recomputedSha256": "70247945ceeacd1bc929d1612cfcc36b0c0c4803e1350505c875b28a036015ca",
  "signatureAgeSeconds": 0,
  "success": true,
  "tampered": false
}

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks