Every /quote and /confirm call from Novig carries an X-Novig-Signature header. Verifying it on every request is how you confirm the call originated from Novig and that the body wasn’t tampered with in transit.
The scheme
- Algorithm: BLAKE3 keyed hash.
- Key: the 32-byte secret you registered, decoded from its hex form.
- Message: the raw bytes of the HTTP body, exactly as received — before any JSON parse or normalization.
- Output: the 32-byte digest, hex-encoded as 64 lowercase characters.
Sign bytes, not parsed JSON. Any whitespace difference, key reordering, or re-serialization will change the digest and the
signature won’t match. Always read the raw body before parsing.
Verifying
Use a BLAKE3 keyed-hash library and a constant-time comparison.
What to do on a bad signature
Reject the request with HTTP 401. Don’t process the body, don’t echo it back, don’t log the signature value. Returning anything in the 2xx range will cause Novig to treat your response as a valid quote/confirm.
Sanity-checking your implementation
You can always hit your own endpoints to confirm they’re verifying signatures and responding correctly. 
