Skip to content

Drop the VERIFY_TOKEN compat alias from sandbox env output #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ord669 merged 1 commit into from
Jul 11, 2026
Merged

Drop the VERIFY_TOKEN compat alias from sandbox env output #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,6 @@ WhatsApp sandbox:

```bash
WEBHOOK_HMAC_SECRET=...
VERIFY_TOKEN=...
PORT=3000
WHATSAPP_API_URL=...
WHATSAPP_ACCESS_TOKEN=...
Expand All @@ -287,17 +286,15 @@ Instagram sandbox:

```bash
WEBHOOK_HMAC_SECRET=...
VERIFY_TOKEN=...
PORT=3000
INSTAGRAM_API_URL=...
INSTAGRAM_ACCESS_TOKEN=...
INSTAGRAM_ACCOUNT_ID=...
```

`WEBHOOK_HMAC_SECRET` is the secret that signs delivered webhook payloads
(the `X-HookMyApp-Signature-256` header). `VERIFY_TOKEN` is a temporary
compatibility alias carrying the same value for older starter-kit setups;
prefer `WEBHOOK_HMAC_SECRET` in new code.
(the `X-HookMyApp-Signature-256` header). Sandbox env blocks do not include
`VERIFY_TOKEN`: the sandbox tunnel never issues the verify-GET handshake.

## Telemetry

Expand Down
2 changes: 1 addition & 1 deletion src/__tests__/starter-kit-alignment.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ const STARTER_KIT_ENV_URL =

const CLI_CANONICAL_KEYS = [
'PORT',
'VERIFY_TOKEN',
'WEBHOOK_HMAC_SECRET',
'WHATSAPP_ACCESS_TOKEN',
'WHATSAPP_API_URL',
'WHATSAPP_PHONE_NUMBER_ID',
Expand Down
7 changes: 2 additions & 5 deletions src/commands/sandbox/__tests__/env.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,12 +55,11 @@ describe('buildEnvBlock — WhatsApp regression', () => {
delete process.env.HOOKMYAPP_SANDBOX_PROXY_URL;
});

it('emits the WA block with WEBHOOK_HMAC_SECRET + the VERIFY_TOKEN compat alias', () => {
it('emits the WA block with WEBHOOK_HMAC_SECRET', () => {
const out = buildEnvBlock(wa);
expect(out).toBe(
[
'WEBHOOK_HMAC_SECRET=HMAC_wa_yyy',
'VERIFY_TOKEN=HMAC_wa_yyy',
'PORT=3000',
'WHATSAPP_API_URL=https://proxy.test/v24.0',
'WHATSAPP_ACCESS_TOKEN=ACT_wa_xxx',
Expand All @@ -79,12 +78,11 @@ describe('buildEnvBlock — Instagram (D2)', () => {
delete process.env.HOOKMYAPP_SANDBOX_PROXY_URL;
});

it('emits the IG block with INSTAGRAM_* vars, v25.0 URL, and both HMAC keys', () => {
it('emits the IG block with INSTAGRAM_* vars, v25.0 URL, and WEBHOOK_HMAC_SECRET', () => {
const out = buildEnvBlock(ig);
expect(out).toBe(
[
'WEBHOOK_HMAC_SECRET=HMAC_ig_yyy',
'VERIFY_TOKEN=HMAC_ig_yyy',
'PORT=3000',
'INSTAGRAM_API_URL=https://proxy.test/v25.0',
'INSTAGRAM_ACCESS_TOKEN=ACT_ig_xxx',
Expand Down Expand Up @@ -139,7 +137,6 @@ describe('runSandboxEnv --json — flat {KEY: VALUE} object', () => {
const parsed = JSON.parse((writeSpy.mock.calls[0][0] as string).trim());
expect(parsed).toEqual({
WEBHOOK_HMAC_SECRET: 'HMAC_ig_yyy',
VERIFY_TOKEN: 'HMAC_ig_yyy',
PORT: '3000',
INSTAGRAM_API_URL: 'https://proxy.test/v25.0',
INSTAGRAM_ACCESS_TOKEN: 'ACT_ig_xxx',
Expand Down
13 changes: 4 additions & 9 deletions src/commands/sandbox/env.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@
// Per D2: WA block uses the WHATSAPP_* prefix (including the WA quirk where
// WHATSAPP_PHONE_NUMBER_ID carries the tester's phone, per spec D4). IG block
// uses the INSTAGRAM_* prefix. Both blocks carry the session's webhook HMAC
// signing secret as WEBHOOK_HMAC_SECRET, plus VERIFY_TOKEN as a temporary
// compat alias (same value) for older starter-kit setups. The webhook verify
// token and the HMAC signing secret are distinct concepts — the alias is
// legacy naming, not an equivalence.
// signing secret as WEBHOOK_HMAC_SECRET. No VERIFY_TOKEN is written: the
// sandbox tunnel never issues the verify-GET handshake, and the temporary
// compat alias for pre-split starter-kits was dropped alongside
// webhook-starter-kit v3 (AIT-126).

import * as fs from 'node:fs';
import type { Command } from 'commander';
Expand Down Expand Up @@ -42,9 +42,6 @@ export function buildEnvPairs(session: SandboxSession): [string, string][] {
case 'whatsapp':
return [
['WEBHOOK_HMAC_SECRET', session.hmacSecret],
// Temporary compat alias — older starter-kit setups read the HMAC
// signing secret from VERIFY_TOKEN. Same value, distinct concept.
['VERIFY_TOKEN', session.hmacSecret],
['PORT', '3000'],
['WHATSAPP_API_URL', `${proxyBase}/${session.whatsappApiVersion}`],
['WHATSAPP_ACCESS_TOKEN', session.accessToken],
Expand All @@ -53,8 +50,6 @@ export function buildEnvPairs(session: SandboxSession): [string, string][] {
case 'instagram':
return [
['WEBHOOK_HMAC_SECRET', session.hmacSecret],
// Temporary compat alias — see the WhatsApp block above.
['VERIFY_TOKEN', session.hmacSecret],
['PORT', '3000'],
['INSTAGRAM_API_URL', `${proxyBase}/${INSTAGRAM_GRAPH_VERSION}`],
['INSTAGRAM_ACCESS_TOKEN', session.accessToken],
Expand Down
Loading