Outgoing Leads API

In order to receive requests from Real Geeks your API needs to be open to the internet. For security reasons you probably want to limit the requests you receive to those coming from Real Geeks. The easier way to do this is to setup a secret token and validate the request.

When your secret token is set Real Geeks will create a hash with the request body. You can see our full implementation in Go below:

func sign(secret, requestBody []byte) string {
    mac := hmac.New(sha256.New, secret)
    mac.Write(requestBody)
    return fmt.Sprintf("%x", mac.Sum(nil))
}

This hash will be available as header X-Lead-Router-Signature. We have a full example of APIs in Go and Python validating the signature below. Obviously, your language and server implementations may differ. There’s a couple important things to point out:

• Only the full request POST body is used to build the hash, no headers
• Using a plain string comparison == is not advised. Use a constant time string comparison function

Sample code in Python using Flask

# API server validating Real Geeks Signature
 
import hmac
import hashlib
from flask import Flask, request
 
app = Flask(__name__)
app.debug = True
 
SECRET = '12345'
 
@app.route("/", methods=["POST"])
def hello():
    signature = str(request.headers['X-Lead-Router-Signature'])
    mac = hmac.new(SECRET, request.data, hashlib.sha256)
    if not hmac.compare_digest(mac.hexdigest(), signature):
        return "invalid signature", 403
    return "ok"
 
if __name__ == "__main__":
    app.run(port=9090)

Sample code in Go

// API server validating Real Geeks Signature
package main
 
import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io/ioutil"
	"log"
	"net/http"
)
 
var secret = []byte("12345")    // your secret here
 
func main() {
	http.HandleFunc("/", handleWebhook)
	log.Print("Listening at 9090")
	http.ListenAndServe(":9090", nil)
}
 
func handleWebhook(w http.ResponseWriter, r *http.Request) {
	signature, err := hex.DecodeString(r.Header.Get("X-Lead-Router-Signature"))
	if err != nil {
		log.Printf("failed to decode signature header (%v)", err)
		w.WriteHeader(500)
		return
	}
	body, err := ioutil.ReadAll(r.Body)
	if err != nil {
		log.Printf("failed to read body (%v)", err)
		w.WriteHeader(500)
		return
	}
	r.Body.Close()
 
	mac := hmac.New(sha256.New, secret)
	mac.Write(body)
	mymac := mac.Sum(nil)
	if !hmac.Equal(mymac, signature) {
		log.Printf("Signature doesn't match")
		w.WriteHeader(403)
		return
	}
	log.Print("ok")
	w.WriteHeader(200)
}