Crypto

Server-side Studio scripts can use Node built-in crypto APIs for common third-party integration signatures, hashes, and request nonces.

Common Methods

Method	Description
createHash(algorithm)	Creates a hash calculator. Common algorithm: sha256
createHmac(algorithm, secret)	Creates an HMAC signer with a secret. Common algorithm: sha256
.update(value, encoding)	Adds text or bytes to the hash or signature input. Use utf8 for normal text
.digest('hex')	Outputs lowercase hexadecimal text. Many APIs use this for signatures
.digest('base64')	Outputs Base64 text. Some APIs require Base64 signatures
randomUUID()	Generates a UUID. Use it as a nonce, request ID, or idempotency key when the external API accepts one
new Date().toISOString()	Generates an ISO timestamp commonly used in signed requests
JSON.stringify(value)	Converts the exact JSON body text that may need to be included in the signature

SHA-256 Hash

import { createHash } from 'node:crypto';

const hash = createHash('sha256')
  .update('content to sign', 'utf8')
  .digest('hex');

HMAC-SHA256 Signature

import { createHmac } from 'node:crypto';

const timestamp = new Date().toISOString();
const bodyText = JSON.stringify({ orderNo: 'SO-1001' });
const signingContent = `${timestamp}\n${bodyText}`;

const signature = createHmac('sha256', 'your-secret')
  .update(signingContent, 'utf8')
  .digest('hex');

Send A Signed Request

const response = await context.http.requestJson({
  url: 'https://example.com/api/orders',
  method: 'POST',
  headers: {
    'x-timestamp': timestamp,
    'x-signature': signature,
  },
  body: bodyText,
});

Random UUID

import { randomUUID } from 'node:crypto';

const nonce = randomUUID();

Notes

Match the third-party platform's exact signing rule. The order of fields, newline characters, JSON formatting, output format such as hex or base64, and timestamp format must be the same as the external system expects.