Can not validate x-hubspot-signature-v3 for CRM extension's requests

Developer Support APIs & Integrations
1

Hello!

I am trying to create a CRM extension, but failed to validate hubspot signature (V3). It works fine for webhooks, but for some reason doesn’t work for CRM extension’s requests. I also tried to use V2, but it doesn’t work also. I tried to replace @ to %20, but it didn’t help

My app ID: 26152491

Request example:

https://my.domain.com/hubspot/dealcard?userId=46434839&userEmail=test@domain.com&associatedObjectId=5330690538&associatedObjectType=DEAL&portalId=26152491&hs_object_id=5330690538

How should I encode URI properly?

2

Hi, @ogelal :waving_hand: Thanks for reaching out. Hey, @Anton @Mark_Ryba have you run into this issue? If we take a step back to the documentation, the v2 request example is still valid and testable — Validating the v2 request signature.

Thank you for taking a look! — Jaycee

3

Hi, @Jaycee_Lewis ! The v2 request example doesn’t contain GET-query parameters and special characters (like CRM extension’s requests have, for example, ?userId=12345&userEmail=user@domain.com). I don’t have any problems with V3 or V3 signature validation for my webhooks.

4

Let me provide a few code examples (python)

V3

timestamp = "1661193700550"secret = "..."method = "GET"uri = "https://api.flowla.dev/hubspot/dealcard"get_params = { "userId": "46434839", "userEmail": "tech@flowla.com", "associatedObjectId": "5330690538", "associatedObjectType": "DEAL", "portalId": "26152491", "hs_object_id": "5330690538", }params = urlencode(get_params)uri = f"{uri}?{params}"body = json.dumps({})rawString = f"{method}{uri}{body}{timestamp}"print(rawString)signature = base64.b64encode( hmac.new( key=bytes(secret, "utf-8"), msg=bytes(rawString, "utf-8"), digestmod=hashlib.sha256 ).digest()).decode()print(signature)

V2

secret = "..."method = "GET"uri = "https://api.flowla.dev/hubspot/dealcard"get_params = { "userId": "46434839", "userEmail": "tech@flowla.com", "associatedObjectId": "5330690538", "associatedObjectType": "DEAL", "portalId": "26152491", "hs_object_id": "5330690538", }params = urlencode(get_params)uri = f"{uri}?{params}"body = json.dumps({})rawString = f"{secret}{method}{uri}{body}"signature = hashlib.sha256(rawString.encode('utf-8')).hexdigest()print(signature)

5

Hi @Jaycee_Lewis ! Finally I found the issue. It’s important to don’t use the request body in the signature if the request method is GET (because my http framework recognizes hubspot GET-request body as {} , and it breaks my signature). I would add this information to the docs.

6

Hey, @ogelal :waving_hand: Thanks for letting us know what worked for you. I’ll submit your feedback. We appreciate you :raising_hands: — Jaycee