Run the gateway: keys & signed webhooks
Mint an API key, call the gateway with it, and receive an HMAC-signed webhook — the Stripe pattern.
Registering an OAuth client needs an invite code, which only an instructor can mint — ask for one at akhil@integrauth.com.
- 1
On your app, create an API key (shown once) and configure an https webhook URL (secret shown once).
The key is stored only as a SHA-256 hash; the webhook signing secret is AES-GCM-encrypted at rest (HMAC needs the plaintext back) — never in the clear.
- 2
Call GET/POST /gateway/echo with header x-api-key: lab_ak_…
The gateway authenticates the key (or an api-scoped OAuth/DPoP token), rate-limits per client (60/min → 429), and reflects a safe echo of your request.
- 3
Send a test event and verify the signature: x-lab-signature = v1=HMAC-SHA256(secret, "<timestamp>.<rawBody>").
Signed webhooks let a receiver trust the payload came from the Lab and wasn’t replayed — recompute the HMAC and compare, exactly like Stripe’s signing scheme.
Do it
This one happens on your account page — register a passkey, revoke a session, or enroll TOTP there.
Go to your account →Learn the theory
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.