Sign a Platform Contract request in five languages.

No external dependencies — Node 18+ has everything in node:crypto.

'use strict';
const crypto = require('node:crypto');

const SKEW_TOLERANCE_MS = 5 * 60 * 1000;

function signRequest(path, secret, timestamp = Date.now()) {
  const payload = `${timestamp}:${path}`;
  const sig = crypto.createHmac('sha256', secret).update(payload).digest('hex');
  return { 'X-Meridian-Timestamp': String(timestamp), 'X-Meridian-Signature': sig };
}

function verifyRequest(path, headers, secret, now = Date.now()) {
  const ts = Number(headers['x-meridian-timestamp']);
  const sig = headers['x-meridian-signature'];
  if (!ts || !sig) return { ok: false, error: 'missing-headers' };
  if (Math.abs(now - ts) > SKEW_TOLERANCE_MS) return { ok: false, error: 'timestamp-skew' };
  const expected = crypto.createHmac('sha256', secret).update(`${ts}:${path}`).digest('hex');
  if (expected.length !== sig.length) return { ok: false, error: 'sig-length' };
  if (!crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(sig, 'hex'))) {
    return { ok: false, error: 'sig-mismatch' };
  }
  return { ok: true };
}

module.exports = { signRequest, verifyRequest };

Stdlib only — hmac, hashlib, time. Works on Python 3.8+.

import hmac
import hashlib
import time

SKEW_TOLERANCE_MS = 5 * 60 * 1000

def sign_request(path: str, secret: str, timestamp: int | None = None) -> dict:
    if timestamp is None:
        timestamp = int(time.time() * 1000)
    payload = f"{timestamp}:{path}".encode("utf-8")
    sig = hmac.new(secret.encode("utf-8"), payload, hashlib.sha256).hexdigest()
    return {"X-Meridian-Timestamp": str(timestamp), "X-Meridian-Signature": sig}

def verify_request(path: str, headers: dict, secret: str, now_ms: int | None = None) -> dict:
    if now_ms is None:
        now_ms = int(time.time() * 1000)
    ts_raw = headers.get("x-meridian-timestamp") or headers.get("X-Meridian-Timestamp")
    sig = headers.get("x-meridian-signature") or headers.get("X-Meridian-Signature")
    if not ts_raw or not sig:
        return {"ok": False, "error": "missing-headers"}
    try:
        ts = int(ts_raw)
    except ValueError:
        return {"ok": False, "error": "timestamp-not-int"}
    if abs(now_ms - ts) > SKEW_TOLERANCE_MS:
        return {"ok": False, "error": "timestamp-skew"}
    payload = f"{ts}:{path}".encode("utf-8")
    expected = hmac.new(secret.encode("utf-8"), payload, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        return {"ok": False, "error": "sig-mismatch"}
    return {"ok": True}

Standard library only. Wire up VerifyMiddleware via net/http.

package meridian

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "errors"
    "fmt"
    "net/http"
    "strconv"
    "time"
)

const skewToleranceMs int64 = 5 * 60 * 1000

func SignRequest(path, secret string) http.Header {
    ts := time.Now().UnixMilli()
    payload := fmt.Sprintf("%d:%s", ts, path)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(payload))
    sig := hex.EncodeToString(mac.Sum(nil))
    h := http.Header{}
    h.Set("X-Meridian-Timestamp", strconv.FormatInt(ts, 10))
    h.Set("X-Meridian-Signature", sig)
    return h
}

func VerifyRequest(path string, headers http.Header, secret string) error {
    tsStr := headers.Get("X-Meridian-Timestamp")
    sigHex := headers.Get("X-Meridian-Signature")
    if tsStr == "" || sigHex == "" {
        return errors.New("missing-headers")
    }
    ts, err := strconv.ParseInt(tsStr, 10, 64)
    if err != nil {
        return errors.New("timestamp-not-int")
    }
    now := time.Now().UnixMilli()
    if abs64(now-ts) > skewToleranceMs {
        return errors.New("timestamp-skew")
    }
    sig, err := hex.DecodeString(sigHex)
    if err != nil {
        return errors.New("sig-not-hex")
    }
    payload := fmt.Sprintf("%d:%s", ts, path)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(payload))
    expected := mac.Sum(nil)
    if !hmac.Equal(expected, sig) {
        return errors.New("sig-mismatch")
    }
    return nil
}

func abs64(n int64) int64 {
    if n < 0 {
        return -n
    }
    return n
}

Stdlib only. Drop into a Rack middleware or a Rails controller filter.

require "openssl"

SKEW_TOLERANCE_MS = 5 * 60 * 1000

def sign_request(path, secret, timestamp: nil)
  timestamp ||= (Time.now.to_f * 1000).to_i
  payload = "#{timestamp}:#{path}"
  sig = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret, payload)
  {
    "X-Meridian-Timestamp" => timestamp.to_s,
    "X-Meridian-Signature" => sig
  }
end

def verify_request(path, headers, secret, now_ms: nil)
  now_ms ||= (Time.now.to_f * 1000).to_i
  ts_raw = headers["x-meridian-timestamp"] || headers["X-Meridian-Timestamp"]
  sig    = headers["x-meridian-signature"] || headers["X-Meridian-Signature"]
  return { ok: false, error: "missing-headers" } if ts_raw.nil? || sig.nil?

  ts = Integer(ts_raw) rescue nil
  return { ok: false, error: "timestamp-not-int" } if ts.nil?
  return { ok: false, error: "timestamp-skew" } if (now_ms - ts).abs > SKEW_TOLERANCE_MS

  expected = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret, "#{ts}:#{path}")
  return { ok: false, error: "sig-length" } if expected.bytesize != sig.bytesize

  # constant-time compare
  matched = expected.bytes.zip(sig.bytes).reduce(0) { |acc, (a, b)| acc | (a ^ b) }
  matched.zero? ? { ok: true } : { ok: false, error: "sig-mismatch" }
end

Pure PHP — hash_hmac + hash_equals for the constant-time compare.

<?php
declare(strict_types=1);

const SKEW_TOLERANCE_MS = 5 * 60 * 1000;

function signRequest(string $path, string $secret, ?int $timestamp = null): array {
    $timestamp = $timestamp ?? (int) round(microtime(true) * 1000);
    $payload = "{$timestamp}:{$path}";
    $sig = hash_hmac('sha256', $payload, $secret);
    return [
        'X-Meridian-Timestamp' => (string) $timestamp,
        'X-Meridian-Signature' => $sig,
    ];
}

function verifyRequest(string $path, array $headers, string $secret, ?int $nowMs = null): array {
    $nowMs = $nowMs ?? (int) round(microtime(true) * 1000);
    $tsRaw = $headers['x-meridian-timestamp'] ?? $headers['X-Meridian-Timestamp'] ?? null;
    $sig   = $headers['x-meridian-signature'] ?? $headers['X-Meridian-Signature'] ?? null;
    if ($tsRaw === null || $sig === null) {
        return ['ok' => false, 'error' => 'missing-headers'];
    }
    if (!ctype_digit((string) $tsRaw)) {
        return ['ok' => false, 'error' => 'timestamp-not-int'];
    }
    $ts = (int) $tsRaw;
    if (abs($nowMs - $ts) > SKEW_TOLERANCE_MS) {
        return ['ok' => false, 'error' => 'timestamp-skew'];
    }
    $expected = hash_hmac('sha256', "{$ts}:{$path}", $secret);
    if (!hash_equals($expected, $sig)) {
        return ['ok' => false, 'error' => 'sig-mismatch'];
    }
    return ['ok' => true];
}