HMAC mismatch Issue

Developer Support APIs & Integrations
1

I am trying to verify the hmac in the

X-HubSpot-Signature V2 but we cannot seem to get a match. I have tried encoding the uri, decoding, encoding just the query string, encoding but with & and = safe, with query string, without, and I don’t even know how many other things. We are receiving a GET request so there is no request body but I have tried including request.json, request.data etc just for funsies. I verified the secret from env_vars does match the secret in my app. I followed the given python example and my code is below:

prehash_string = env_vars[‘hubspot_crm_card_secret’] + request.method + request.url

hashed_string = hashlib.sha256(prehash_string.encode(‘utf-8’)).hexdigest()

print(f’{hashed_string} == {hubspot_signature}')

if hashed_string == hubspot_signature:

print(‘authorized’)

return True

return False

Any idea what I am missing here?

2

In case someone else has this issue, I solved it by adding:

url = urllib.parse.unquote(request.url).replace(‘http’, ‘https’, 1)

For some reason request.url came through as http but the hmac had https and the @'s in the query were encodded but nothing else was. I only replaced the first http because my query included the domains