Agent work in. Human signatures only.

curl --request POST "$SIGNTHATUP_ORIGIN/api/v1/acceptances" \
  --header "Authorization: Bearer $SIGNTHATUP_AGENT_KEY" \
  --header "Idempotency-Key: acceptance.create.0001" \
  --header "Content-Type: application/json" \
  --data '{"jobId":"job_existing_0001"}'

curl --request POST \
  "$SIGNTHATUP_ORIGIN/api/v1/acceptances/acceptance_0001/evidence" \
  --header "Authorization: Bearer $SIGNTHATUP_AGENT_KEY" \
  --header "Idempotency-Key: evidence.attach.0001" \
  --header "Content-Type: application/json" \
  --data '{
    "bytesBase64":"AQID",
    "evidenceId":"evidence_photo_0001",
    "kind":"photo",
    "mimeType":"image/jpeg",
    "recordedAt":"2026-07-17T12:00:00.000Z",
    "sequence":0
  }'

curl --request POST \
  "$SIGNTHATUP_ORIGIN/api/v1/acceptances/acceptance_0001/request-signatures" \
  --header "Authorization: Bearer $SIGNTHATUP_AGENT_KEY" \
  --header "Idempotency-Key: signatures.request.0001"

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody is the untouched request body Buffer. Verify before JSON.parse.
const received = request.headers["x-signthatup-signature"]
  ?.match(/^v1=([A-Za-z0-9_-]{43})$/)?.[1];
const key = Buffer.from(process.env.RECEIVER_WEBHOOK_KEY_BASE64!, "base64");
const expected = createHmac("sha256", key)
  .update(rawBody)
  .digest("base64url");

if (!received || !timingSafeEqual(Buffer.from(received), Buffer.from(expected))) {
  throw new Error("invalid webhook signature");
}

// Insert x-signthatup-event-id under a unique constraint, then process once.

POST /api/v1/mcp HTTP/1.1
Authorization: Bearer $SIGNTHATUP_AGENT_KEY
Accept: application/json, text/event-stream
Content-Type: application/json
MCP-Protocol-Version: 2025-11-25

{
  "jsonrpc":"2.0",
  "id":1,
  "method":"initialize",
  "params":{
    "protocolVersion":"2025-11-25",
    "capabilities":{},
    "clientInfo":{"name":"your-agent","version":"1.0.0"}
  }
}