> ## Documentation Index
> Fetch the complete documentation index at: https://docs.woopilot.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# HMAC-SHA256 Cryptographic Protocol

> End-to-end request signing, replay attack protection, and initiator audit logging

# HMAC-SHA256 Protocol 🔐

Every HTTP request between the **WooPilot Cloud Core** orchestrator and the merchant's **WordPress plugin** is cryptographically signed using a unique, 256-bit symmetric secret key generated during the initial QR handshake.

***

## 🧮 Cryptographic Formula

$\text{Signature} = \text{hash\_hmac}\left(\text{'sha256'}, \text{X-HUB-Timestamp} + \text{RAW\_JSON\_PAYLOAD}, \text{hmac\_secret}\right)$

```http theme={null}
X-HUB-Timestamp: 1770000000
X-HUB-Fingerprint: 5dda962d44f54a70db3ae7f9426d83868d628716c6ec0934f1dc2c80661fd1ba
X-HUB-Signature: e4a180021780b62e138ca2136c7ad9bcd4bba2618fe2da764b51555b22cc45ca
X-HUB-User-Telegram-ID: 123456789
X-HUB-User-Username: alex_manager
X-HUB-User-Role: OWNER
Content-Type: application/json
```

***

## 🛡️ Key Security Properties

1. **Replay Attack Defense:** The plugin checks `abs(time() - X-HUB-Timestamp) <= 300` seconds. Any captured packet replayed after 5 minutes is discarded.
2. **Constant-Time Verification:** Signatures are compared using `hash_equals()` in PHP and `crypto.timingSafeEqual()` in Node.js, completely mitigating timing side-channel attacks.
3. **Traceable Initiator Audit Log:** Requests forward the initiator's Telegram user ID and username, which are permanently logged in the WordPress plugin's local **Security Audit Log**.


## Related topics

- [Telegram Mini App (TMA) Suite](/tma/overview.md)
- [Frequently Asked Questions](/faq.md)
- [Introduction](/introduction.md)
- [GDPR Compliance & Zero-PII Policy](/security/gdpr-pii-masking.md)