Quick Start

import { createVerify } from 'node:crypto'

function isValidSignature(rawBody: string, signature: string, marblesPublicKey: string): boolean {
  return createVerify('RSA-SHA256')
    .update(rawBody)
    .verify(marblesPublicKey, signature, 'base64')
}

// Usage in your /balance, /bet, /win, /rollback handlers
const signature = req.headers['x-marbles-signature'] as string
if (!isValidSignature(rawBody, signature, marblesPublicKey)) {
  return res.status(200).json({ status: 'INVALID_SIGNATURE', requestId, clientPlayerId })
}

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
import base64

def is_valid_signature(raw_body: bytes, signature: str, marbles_public_key_pem: str) -> bool:
    public_key = serialization.load_pem_public_key(marbles_public_key_pem.encode())
    try:
        public_key.verify(
            base64.b64decode(signature),
            raw_body,
            padding.PKCS1v15(),
            hashes.SHA256()
        )
        return True
    except Exception:
        return False

# Usage in your /balance, /bet, /win, /rollback handlers
signature = request.headers['X-Marbles-Signature']
if not is_valid_signature(raw_body, signature, marbles_public_key):
    return jsonify({'status': 'INVALID_SIGNATURE', 'requestId': request_id, 'clientPlayerId': player_id}), 200

function isValidSignature(string $rawBody, string $signature, string $marblesPublicKey): bool {
    return openssl_verify(
        $rawBody,
        base64_decode($signature),
        $marblesPublicKey,
        OPENSSL_ALGO_SHA256
    ) === 1;
}

// Usage in your /balance, /bet, /win, /rollback handlers
$signature = $_SERVER['HTTP_X_MARBLES_SIGNATURE'];
$rawBody = file_get_contents('php://input');
if (!isValidSignature($rawBody, $signature, $marblesPublicKey)) {
    http_response_code(200);
    echo json_encode(['status' => 'INVALID_SIGNATURE', 'requestId' => $requestId, 'clientPlayerId' => $playerId]);
    exit;
}