Make

The module

Use the HTTP module, Make a request. URL https://app.refilloapp.com/api/v1/needs-you. Method GET. Headers: Authorization with the value Bearer and the key. Add the key as a scenario variable, not as text in the URL. Parse the response. The items array is Today's list, in Today's order. Each item has a deadline and an action.

A webhook from Refillo

Add a Custom webhook module and give Refillo that https URL. Before you use the body, run the Python check. The header to read is Refillo-Signature. Compare against the raw body, not a re-encoded one.

The check

This is the Python check. The test runs examples/python/verify_webhook.py.

"""The webhook check from the docs. Run: python verify_webhook.py"""

import hashlib
import hmac
import time


def verify(secret: str, header: str, raw: bytes, now: int | None = None) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts["t"])
    if abs((now or int(time.time())) - t) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])


if __name__ == "__main__":
    secret = "whsec_example"
    body = b'{"id":"1"}'
    t = 1_700_000_000
    mac = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    header = f"t={t},v1={mac}"
    assert verify(secret, header, body, t)
    assert not verify(secret, header, b"other", t)
    print("verify_webhook ok")