# Zero Hash Webhooks

## When to Use This Skill

* How do I receive Zero Hash webhooks?
* How do I verify Zero Hash webhook signatures (`x-zh-hook-signature`)?
* How do I handle `trade_status_changed` and `payment_status_changed` events?
* Why is my Zero Hash webhook signature verification failing?
* How do I guard Zero Hash webhooks against replay attacks with `x-zh-hook-timestamp`?

## Verification (core)

Zero Hash signs the raw request body with HMAC-SHA256 and sends the
digest as a hex string. There is no webhook SDK — verify manually.

The recommended (replay-protected) scheme signs `payload + timestamp`
(concatenated raw strings, no delimiter) and sends:

* `x-zh-hook-signature` — `to_hex(hmac_sha256(payload + timestamp, secret))`
* `x-zh-hook-timestamp` — the UNIX timestamp that was signed

Reject the request if the timestamp is not within ±5 minutes of your clock, then
compare the signature timing-safe. Zero Hash documents the ±5 minute window but
not whether the timestamp is in seconds or milliseconds, so normalize the
value before comparing rather than assuming a unit:

```javascript
const crypto = require('crypto');

// The unit of x-zh-hook-timestamp is not documented. A ~10-digit value is
// seconds, a ~13-digit value is milliseconds — normalize to ms either way.
function toMillis(timestamp) {
  const value = Number(timestamp);
  if (!Number.isFinite(value)) return NaN;
  return Math.abs(value) < 1e11 ? value * 1000 : value;
}

function verifyZeroHash(rawBody, signature, timestamp, secret, toleranceMs = 5 * 60 * 1000) {
  if (!signature || !timestamp) return false;
  // Replay guard: accept either seconds or milliseconds.
  const timestampMs = toMillis(timestamp);
  if (!Number.isFinite(timestampMs)) return false;
  if (Math.abs(Date.now() - timestampMs) > toleranceMs) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody + timestamp, 'utf8') // payload + timestamp, no delimiter
    .digest('hex');
  try {
    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
  } catch {
    return false; // length mismatch => invalid
  }
}

```

> Legacy scheme: older integrations send `x-zh-hook-signature-256 = to_hex(hmac_sha256(payload, secret))` with no timestamp. RSA-SHA256 variants
> (`x-zh-hook-rsa-signature` / `x-zh-hook-rsa-signature-256`, verified with a
> Zero Hash public key) are also offered. See [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/zerohash-webhooks/references/verification.md).

> For complete handlers with route wiring, event dispatch, and tests, see:
> 
> * [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/zerohash-webhooks/examples/express/)
> * [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/zerohash-webhooks/examples/nextjs/)
> * [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/zerohash-webhooks/examples/fastapi/)

## Common Event Types

The event type is carried in the `x-zh-hook-payload-type` header (not in the body).

| `x-zh-hook-payload-type` | Triggered When |
| --- | --- |
| `trade_status_changed` | A trade's settlement status changes (`accepted`, `active`, `terminated`) |
| `payment_status_changed` | A payment's status changes |
| `account_balance.changed` (unconfirmed spelling) | An `available` or `collateral` account balance changes |

> Confirm these strings with your Zero Hash rep before dispatching on them.
> Zero Hash's own documentation is inconsistent about event naming: the same
> event appears as the header value `trade_status_changed` in one place and as
> `trade.status_changed` / `account_balance.changed` in another.
> `trade_status_changed` and `payment_status_changed` are the safest forms.
> Treat every dot-form name as unconfirmed, log the
> `x-zh-hook-payload-type` values you actually receive, and match your handler
> to those.

> For full event and payload reference, see [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/zerohash-webhooks/references/overview.md).

## Important Headers

| Header | Description |
| --- | --- |
| `x-zh-hook-signature` | HMAC-SHA256 (hex) of `payload + timestamp` — recommended |
| `x-zh-hook-timestamp` | UNIX timestamp that was signed; used for the replay check (unit not documented — handle seconds or ms) |
| `x-zh-hook-signature-256` | Legacy HMAC-SHA256 (hex) of `payload` only, no timestamp |
| `x-zh-hook-rsa-signature` / `x-zh-hook-rsa-signature-256` | RSA-SHA256 (hex) variants |
| `x-zh-hook-payload-type` | Event type (e.g. `trade_status_changed`) |
| `x-zh-hook-notification-id` | Unconfirmed — a per-notification id useful for idempotency, but not documented in the material this skill was built from. Read it defensively and fall back to a body field or a hash of the payload if it is absent. |

## Environment Variables

```bash
ZEROHASH_WEBHOOK_SECRET=your_zero_hash_hmac_shared_secret   # provisioned by your Zero Hash rep

```

Subscriptions are not self-service: a Zero Hash representative configures your
destination URL and provisions the HMAC shared secret (or an RSA public key). See
[references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/zerohash-webhooks/references/setup.md).

## Local Development

```bash
# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 zerohash --path /webhooks/zerohash

```

## Reference Materials

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/zerohash-webhooks/references/overview.md) - Zero Hash webhook concepts and events
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/zerohash-webhooks/references/setup.md) - Configuration and shared secret provisioning
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/zerohash-webhooks/references/verification.md) - Signature verification details and gotchas