Live updates

As a meeting unfolds, Aura sends your app a signed update for each thing that happens.

What you'll hear about

Each update carries an eventId, a sequence number counting up from 1 for that meeting, the time it happened (occurredAt) and, where it concerns a guest, that participant.

Check the signature first

Every delivery has an X-Aura-Signature header in the form t=<unix time>,v1=<hex>. The hex is an HMAC-SHA256 of the time, a dot and the raw request body, made with your signing secret. Check it against the raw bytes before parsing, and refuse anything older than five minutes.

import crypto from 'node:crypto'

export function verify(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')))
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false
  const mac = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  return mac.length === v1.length && crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(v1))
}

Acknowledge, then work

Reply with any 2xx to acknowledge. Anything else is retried six times with growing gaps, after which the update stays available in the meeting's history. Updates for one meeting arrive in order.

• Expect the occasional repeat and ignore any eventId you have already handled.
• Keep unfamiliar update types. Aura may add new ones. Store and count them even if you don't act on them, so your sequence numbers stay complete.