Integrate your POS with

// HMAC-SHA256 verification — Node.js (built-in crypto)
const crypto = require('crypto');

function verifyBipBipSignature(secret, timestamp, rawBody, signature) {
  // Reject requests older than 5 minutes (replay protection)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > 300) return false;

  // Sign the RAW body — never JSON.parse + re-serialize
  const message = `${timestamp}.${rawBody}`;
  const computed = crypto
    .createHmac('sha256', secret)
    .update(message, 'utf8')
    .digest('hex');
  const expected = `sha256=${computed}`;

  // Timing-safe comparison (never use === on signatures)
  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(signature, 'utf8');
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

# HMAC-SHA256 verification — Python (stdlib only)
import hmac, hashlib, time

def verify_bipbip_signature(secret: str, timestamp: str, raw_body: bytes, signature: str) -> bool:
    # Reject requests older than 5 minutes
    if abs(int(time.time()) - int(timestamp)) > 300:
        return False

    # Build the exact message BipBip signed: "{ts}.{rawBody}"
    message = f"{timestamp}.".encode("utf-8") + raw_body
    computed = hmac.new(secret.encode("utf-8"), message, hashlib.sha256).hexdigest()
    expected = f"sha256={computed}"

    # Timing-safe comparison
    return hmac.compare_digest(expected, signature)

// HMAC-SHA256 verification — C# (.NET 6+)
using System.Security.Cryptography;
using System.Text;

public static bool VerifyBipBipSignature(string secret, string timestamp, byte[] rawBody, string signature) {
    // Reject requests older than 5 minutes
    var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
    if (Math.Abs(now - long.Parse(timestamp)) > 300) return false;

    var prefix = Encoding.UTF8.GetBytes($"{timestamp}.");
    var message = prefix.Concat(rawBody).ToArray();

    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var computed = Convert.ToHexString(hmac.ComputeHash(message)).ToLowerInvariant();
    var expected = Encoding.UTF8.GetBytes($"sha256={computed}");
    var received = Encoding.UTF8.GetBytes(signature);

    return CryptographicOperations.FixedTimeEquals(expected, received);
}

// HMAC-SHA256 verification — PHP 7.2+
function verify_bipbip_signature(string $secret, string $timestamp, string $rawBody, string $signature): bool {
    // Reject requests older than 5 minutes
    if (abs(time() - (int)$timestamp) > 300) return false;

    // Sign the raw body — never re-serialize the parsed JSON
    $message  = $timestamp . '.' . $rawBody;
    $computed = hash_hmac('sha256', $message, $secret);
    $expected = 'sha256=' . $computed;

    // Constant-time comparison to avoid timing oracles
    return hash_equals($expected, $signature);
}