# `Noizu.Slack.Signature`
[🔗](https://github.com/noizu-labs-sdks/elixir-slack/blob/v0.1.0/lib/noizu/slack/signature.ex#L1)

Verifies Slack request signatures (Events API, slash commands, interactivity).

Slack sends `X-Slack-Request-Timestamp` and `X-Slack-Signature`
(`v0=<hex HMAC-SHA256(signing_secret, "v0:" <> timestamp <> ":" <> raw_body)>`).
Verify against the **raw** request body, before any JSON/form parsing.

    :ok = Noizu.Slack.Signature.verify(secret, ts_header, raw_body, sig_header)

Requests older (or newer) than the replay window (default 300 s) are rejected.
Comparison is constant-time.

# `sign`

```elixir
@spec sign(String.t(), String.t() | integer(), iodata()) :: String.t()
```

Computes the `v0=<hex>` signature for `timestamp` + `body` (useful in tests).

# `verify`

```elixir
@spec verify(
  String.t(),
  String.t() | integer(),
  iodata(),
  String.t() | nil,
  keyword()
) ::
  :ok | {:error, Noizu.Slack.Error.t()}
```

Verifies a request. Returns `:ok` or `{:error, %Error{tag: :signature, reason: r}}`
with `r` in `:invalid_timestamp | :stale_timestamp | :invalid_signature`.

Options: `:tolerance` (seconds, default 300), `:now` (unix seconds; default
`System.os_time(:second)`).

---

*Consult [api-reference.md](api-reference.md) for complete listing*