Hub REST API

curl -X POST https://auth.corsair.dev/connect/sessions \
  -H "Authorization: Bearer $CORSAIR_DEV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "user_123",
    "deliveryUrl": "https://yourapp.com/api/corsair",
    "plugins": [{ "plugin": "github", "oauthMode": "managed" }]
  }'

const res = await fetch("https://auth.corsair.dev/connect/sessions", {
    method: "POST",
    headers: {
        Authorization: `Bearer ${process.env.CORSAIR_DEV_API_KEY}`,
        "Content-Type": "application/json",
    },
    body: JSON.stringify({
        tenantId: "user_123",
        deliveryUrl: "https://yourapp.com/api/corsair",
        plugins: [{ plugin: "github", oauthMode: "managed" }],
    }),
});
const { connectUrl } = await res.json();

import os, requests

res = requests.post(
    "https://auth.corsair.dev/connect/sessions",
    headers={"Authorization": f"Bearer {os.environ['CORSAIR_DEV_API_KEY']}"},
    json={
        "tenantId": "user_123",
        "deliveryUrl": "https://yourapp.com/api/corsair",
        "plugins": [{"plugin": "github", "oauthMode": "managed"}],
    },
)
connect_url = res.json()["connectUrl"]

payload, _ := json.Marshal(map[string]any{
    "tenantId":    "user_123",
    "deliveryUrl": "https://yourapp.com/api/corsair",
    "plugins":     []map[string]string{{"plugin": "github", "oauthMode": "managed"}},
})
req, _ := http.NewRequest("POST", "https://auth.corsair.dev/connect/sessions", bytes.NewReader(payload))
req.Header.Set("Authorization", "Bearer "+os.Getenv("CORSAIR_DEV_API_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

import hashlib, hmac, time

def verify(raw_body: bytes, headers, signing_secret: str) -> bool:
    sig = headers["x-corsair-signature"].removeprefix("sha256=")
    ts = int(headers["x-corsair-timestamp"])
    if abs(time.time() - ts) > 300:            # reject stale deliveries
        return False
    expected = hmac.new(signing_secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(sig, expected)   # constant-time compare

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody: Buffer, headers: Record<string, string>, signingSecret: string): boolean {
    const sig = headers["x-corsair-signature"].replace(/^sha256=/, "");
    const ts = parseInt(headers["x-corsair-timestamp"] ?? "0", 10);
    if (isNaN(ts) || Math.abs(Date.now() / 1000 - ts) > 300) return false; // reject stale or malformed
    const expected = createHmac("sha256", signingSecret).update(rawBody).digest("hex");
    const a = Buffer.from(sig), b = Buffer.from(expected);
    return a.length === b.length && timingSafeEqual(a, b); // constant-time
}

func verify(rawBody []byte, headers http.Header, signingSecret string) bool {
    sig := strings.TrimPrefix(headers.Get("x-corsair-signature"), "sha256=")
    ts, _ := strconv.ParseInt(headers.Get("x-corsair-timestamp"), 10, 64)
    if math.Abs(float64(time.Now().Unix()-ts)) > 300 { // reject stale
        return false
    }
    mac := hmac.New(sha256.New, []byte(signingSecret))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(sig), []byte(expected)) // constant-time
}