# Step 1: Define your body
BODY='{"method":"gateway.ping","params":{}}'

# Step 2: Compute the SHA512 hash and replay proof
# Concatenate body + secret key, then hash
HASH=$(printf '%s%s' "${BODY}" "your_secret_key" | sha512sum | awk '{print $1}')
TIMESTAMP=$(date +%s)
NONCE=$(uuidgen | tr '[:upper:]' '[:lower:]')

# Step 3: Send the request
curl -X POST https://api.bafanglaicai88.com/public/api/multihub/v1 \
  -H "Content-Type: application/json" \
  -H "X-Data-Application-Id: 1" \
  -H "X-Data-Hash: ${HASH}" \
  -H "X-Data-Timestamp: ${TIMESTAMP}" \
  -H "X-Data-Nonce: ${NONCE}" \
  --data-binary "${BODY}"

import hashlib
import json
import time
import uuid
import requests

APP_ID = "1"
SECRET_KEY = "your_secret_key"
BASE_URL = "https://api.bafanglaicai88.com/public/api/multihub/v1"

# Step 1: Prepare the request body
body = {"method": "gateway.ping", "params": {}}
body_str = json.dumps(body, separators=(',', ':'))

# Step 2: Compute the SHA512 hash
hash_value = hashlib.sha512((body_str + SECRET_KEY).encode()).hexdigest()

# Step 3: Send the request
response = requests.post(BASE_URL, data=body_str, headers={
    "Content-Type": "application/json",
    "X-Data-Application-Id": APP_ID,
    "X-Data-Hash": hash_value,
    "X-Data-Timestamp": str(int(time.time())),
    "X-Data-Nonce": str(uuid.uuid4()),
}, timeout=(3.05, 30))

print(response.json())

const crypto = require("crypto");

const APP_ID = "1";
const SECRET_KEY = "your_secret_key";
const BASE_URL = "https://api.bafanglaicai88.com/public/api/multihub/v1";

// Step 1: Prepare the request body
const body = { method: "gateway.ping", params: {} };
const bodyStr = JSON.stringify(body);

// Step 2: Compute the SHA512 hash
const hash = crypto
  .createHash("sha512")
  .update(bodyStr + SECRET_KEY)
  .digest("hex");
const timestamp = Math.floor(Date.now() / 1000).toString();
const nonce = crypto.randomUUID();

// Step 3: Send the request
const response = await fetch(BASE_URL, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Data-Application-Id": APP_ID,
    "X-Data-Hash": hash,
    "X-Data-Timestamp": timestamp,
    "X-Data-Nonce": nonce,
  },
  body: bodyStr,
  signal: AbortSignal.timeout(30000),
});

const data = await response.json();
console.log(data);

<?php
$appId = '1';
$secretKey = 'your_secret_key';
$baseUrl = 'https://api.bafanglaicai88.com/public/api/multihub/v1';

// Step 1: Prepare the request body
$body = json_encode([
    'method' => 'gateway.ping',
    'params' => new stdClass(),
]);

// Step 2: Compute the SHA512 hash
$hash = hash('sha512', $body . $secretKey);
$timestamp = (string) time();
$nonce = bin2hex(random_bytes(16));

// Step 3: Send the request
$ch = curl_init($baseUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    "X-Data-Application-Id: $appId",
    "X-Data-Hash: $hash",
    "X-Data-Timestamp: $timestamp",
    "X-Data-Nonce: $nonce",
]);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

package main

import (
	"bytes"
	"crypto/sha512"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"time"
)

func main() {
	appID := "1"
	secretKey := "your_secret_key"
	baseURL := "https://api.bafanglaicai88.com/public/api/multihub/v1"

	// Step 1: Prepare the request body
	body := map[string]interface{}{
		"method": "gateway.ping",
		"params": map[string]interface{}{},
	}
	bodyBytes, _ := json.Marshal(body)

	// Step 2: Compute the SHA512 hash
	hasher := sha512.New()
	hasher.Write(bodyBytes)
	hasher.Write([]byte(secretKey))
	hashHex := hex.EncodeToString(hasher.Sum(nil))
	timestamp := fmt.Sprintf("%d", time.Now().Unix())
	nonce := fmt.Sprintf("%d", time.Now().UnixNano())

	// Step 3: Send the request
	req, _ := http.NewRequest("POST", baseURL, bytes.NewBuffer(bodyBytes))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-Data-Application-Id", appID)
	req.Header.Set("X-Data-Hash", hashHex)
	req.Header.Set("X-Data-Timestamp", timestamp)
	req.Header.Set("X-Data-Nonce", nonce)

	client := &http.Client{Timeout: 30 * time.Second}
	resp, _ := client.Do(req)
	defer resp.Body.Close()

	respBody, _ := io.ReadAll(resp.Body)
	fmt.Println(string(respBody))
}

import hashlib
import hmac

def verify_webhook(raw_body: bytes, signature: str, webhook_secret: str) -> bool:
    expected = hashlib.sha512(raw_body + webhook_secret.encode()).hexdigest()
    return hmac.compare_digest(expected, signature)  # constant-time comparison

const crypto = require("crypto");

function verifyWebhook(rawBody, signature, webhookSecret) {
  const expected = crypto
    .createHash("sha512")
    .update(Buffer.concat([Buffer.from(rawBody), Buffer.from(webhookSecret)]))
    .digest("hex");
  if (!/^[a-f0-9]{128}$/i.test(signature || "")) {
    return false;
  }
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex"),
  );
}

function verifyWebhookV2(rawBody, signature, timestamp, webhookSecret) {
  const timestampMs = Date.parse(timestamp || "");
  if (
    !Number.isFinite(timestampMs) ||
    Math.abs(Date.now() - timestampMs) > 5 * 60 * 1000
  ) {
    return false;
  }
  const expected = crypto
    .createHash("sha512")
    .update(
      String(timestamp) + Buffer.from(rawBody).toString("utf8") + webhookSecret,
    )
    .digest("hex");
  if (!/^[a-f0-9]{128}$/i.test(signature || "")) {
    return false;
  }
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex"),
  );
}

function verifyWebhookV3(
  rawBody,
  signature,
  timestamp,
  nonce,
  webhookId,
  webhookSecret,
) {
  const timestampMs = Date.parse(timestamp || "");
  if (!timestamp || !nonce || !webhookId || !Number.isFinite(timestampMs)) {
    return false;
  }
  if (Math.abs(Date.now() - timestampMs) > 5 * 60 * 1000) {
    return false;
  }
  const expected = crypto
    .createHmac("sha512", webhookSecret)
    .update(
      [timestamp, nonce, webhookId, Buffer.from(rawBody).toString("utf8")].join(
        ".",
      ),
    )
    .digest("hex");
  if (!/^[a-f0-9]{128}$/i.test(signature || "")) {
    return false;
  }
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex"),
  );
}

<?php
function verifyWebhook(string $rawBody, string $signature, string $webhookSecret): bool {
    $expected = hash('sha512', $rawBody . $webhookSecret);
    return hash_equals($expected, $signature);
}

import (
	"crypto/sha512"
	"crypto/subtle"
	"encoding/hex"
)

func verifyWebhook(rawBody []byte, signature string, webhookSecret string) bool {
	hasher := sha512.New()
	hasher.Write(rawBody)
	hasher.Write([]byte(webhookSecret))
	expected := hex.EncodeToString(hasher.Sum(nil))
	return subtle.ConstantTimeCompare([]byte(expected), []byte(signature)) == 1
}