Custom Tools

from flask import Flask, request, jsonify
import os

app = Flask(__name__)

@app.route('/api/order-status', methods=['POST'])
def order_status():
    auth_header = request.headers.get('Authorization')

    # Check for Bearer token
    if not auth_header or not auth_header.startswith('Bearer '):
        return jsonify({
            'success': False,
            'error': 'Missing authorization'
        }), 401

    token = auth_header.split(' ')[1]
    
    # Verify against your environment variable
    if token != os.environ.get('BUBBLAV_SECRET_KEY'):
        return jsonify({
            'success': False,
            'error': 'Invalid token'
        }), 401

    # Process request...
    return jsonify({ 'success': True, 'data': { 'status': 'shipped' } })

import hmac
import hashlib
import time
import json
import os
from flask import Flask, request, jsonify

app = Flask(__name__)

def verify_signature(body, signature, secret, timestamp):
    # Create the payload string exactly as BubblaV does: timestamp + . + json_body
    # Note: separators=(',', ':') ensures standard JSON formatting without whitespace
    payload = f"{timestamp}.{json.dumps(body, separators=(',', ':'))}"
    
    expected = hmac.new(
        secret.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(signature, expected)

@app.route('/api/secure-endpoint', methods=['POST'])
def secure_endpoint():
    # Get headers
    signature = request.headers.get('X-BubblaV-Signature', '').replace('sha256=', '')
    timestamp = request.headers.get('X-BubblaV-Timestamp')

    if not timestamp or not signature:
         return jsonify({'success': False, 'error': 'Missing signature headers'}), 401

    # Check timestamp (5 min tolerance) to prevent replay attacks
    if time.time() - int(timestamp) / 1000 > 300:
        return jsonify({'success': False, 'error': 'Request expired'}), 401

    # Verify signature
    if not verify_signature(request.json, signature, os.environ['SECRET'], timestamp):
        return jsonify({'success': False, 'error': 'Invalid signature'}), 401

    # Process authenticated request...
    return jsonify({'success': True, 'message': 'Verified!'})

{
  "success": false,
  "error": "Order not found: ORD-99999",
  "data": null
}