Thread Discussion

Hey all - I'm working on a public apps UI extension and I'm having issues validating the signature coming on the HS fetch. No matter what I've done, it seems to be computing a different signature and I can't for the life of me get it to work. I'm using the following data in junction with the hubspot Signature class in python, using get_signature with the following payload:

client_secret: "1c87xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
request_body: "{}"
signature_version: "v3"
http_uri: "https://readai-tamzin-dj38h1df.ngrok.io/integrations/hubspot/test"
http_method: "POST"
timestamp: "1743360672536" // from header

And when I inspect the proxy request, this is what I see:

{
  "requestUri": "https://readai-tamzin-dj38h1df.ngrok.io/integrations/hubspot/test",
  "requestBody": {},
  "method": "POST",
  "appId": 3334958,
  "cardId": "101093516",
  "cardTitle": "Hello Public App",
  "objectId": 109451697941,
  "objectTypeId": "0-1",
  "requestHeaders": {}
}

My computed signature: E+Ks9XtdJ/sbp0RAZ4yLLehVPHHgBscBB+sXY0AGfWo= vs. the one on the v3 header: puRiBE49ZInUhggOgfEmgcbKrTMVvK2S/i76D6TJuds=

So for all intensive purposes, this should be working but it's not. My current theory is that the client secret I am using is wrong, and that there is another client secret I should be using (this is the one for oauth), but there isn't another client secret to use (at least that I've been able to find, and I've looked everywhere).

This is a blocker right now on our company's ability to validate requests and thus ship our UI extension. Does anyone have some insight here that could help unblock us? Is there something I am missing?