Zero Hash Webhooks Skill

When to Use This Skill

• How do I receive Zero Hash webhooks?
• How do I verify Zero Hash webhook signatures (x-zh-hook-signature)?
• How do I handle trade_status_changed and payment_status_changed events?
• Why is my Zero Hash webhook signature verification failing?
• How do I guard Zero Hash webhooks against replay attacks with x-zh-hook-timestamp?

Verification (core)

Zero Hash signs the raw request body with HMAC-SHA256 and sends the digest as a hex string. There is no webhook SDK — verify manually.

The recommended (replay-protected) scheme signs payload + timestamp (concatenated raw strings, no delimiter) and sends:

• x-zh-hook-signature — to_hex(hmac_sha256(payload + timestamp, secret))
• x-zh-hook-timestamp — the UNIX timestamp that was signed

Reject the request if the timestamp is not within ±5 minutes of your clock, then compare the signature timing-safe. Zero Hash documents the ±5 minute window but not whether the timestamp is in seconds or milliseconds, so normalize the value before comparing rather than assuming a unit:

const crypto = require('crypto');

// The unit of x-zh-hook-timestamp is not documented. A ~10-digit value is
// seconds, a ~13-digit value is milliseconds — normalize to ms either way.
function toMillis(timestamp) {
  const value = Number(timestamp);
  if (!Number.isFinite(value)) return NaN;
  return Math.abs(value) < 1e11 ? value * 1000 : value;
}

function verifyZeroHash(rawBody, signature, timestamp, secret, toleranceMs = 5 * 60 * 1000) {
  if (!signature || !timestamp) return false;
  // Replay guard: accept either seconds or milliseconds.
  const timestampMs = toMillis(timestamp);
  if (!Number.isFinite(timestampMs)) return false;
  if (Math.abs(Date.now() - timestampMs) > toleranceMs) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody + timestamp, 'utf8') // payload + timestamp, no delimiter
    .digest('hex');
  try {
    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
  } catch {
    return false; // length mismatch => invalid
  }
}

Legacy scheme: older integrations send x-zh-hook-signature-256 = to_hex(hmac_sha256(payload, secret)) with no timestamp. RSA-SHA256 variants (x-zh-hook-rsa-signature / x-zh-hook-rsa-signature-256, verified with a Zero Hash public key) are also offered. See references/verification.md.

For complete handlers with route wiring, event dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Common Event Types

The event type is carried in the x-zh-hook-payload-type header (not in the body).

Confirm these strings with your Zero Hash rep before dispatching on them. Zero Hash's own documentation is inconsistent about event naming: the same event appears as the header value trade_status_changed in one place and as trade.status_changed / account_balance.changed in another. trade_status_changed and payment_status_changed are the safest forms. Treat every dot-form name as unconfirmed, log the x-zh-hook-payload-type values you actually receive, and match your handler to those.

For full event and payload reference, see references/overview.md.

Important Headers

Environment Variables

ZEROHASH_WEBHOOK_SECRET=your_zero_hash_hmac_shared_secret   # provisioned by your Zero Hash rep

Subscriptions are not self-service: a Zero Hash representative configures your destination URL and provisions the HMAC shared secret (or an RSA public key). See references/setup.md.

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 zerohash --path /webhooks/zerohash

Reference Materials

• references/overview.md - Zero Hash webhook concepts and events
• references/setup.md - Configuration and shared secret provisioning
• references/verification.md - Signature verification details and gotchas