Integrate identity validation in one afternoon.

const res = await fetch("https://antivamp.io/api/v1/launches/validate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ANTIVAMP_API_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": launchAttemptId,
  },
  body: JSON.stringify({
    chain: "hyperliquid",
    launchpad: "your-launchpad",
    name, ticker, launcher,
    nonce: launchAttemptId,
  }),
});

if (!res.ok) {
  // AntiVamp fails closed: treat errors as "do not launch".
  throw new Error(`validation unavailable (${res.status})`);
}
const decision = await res.json();
if (decision.decision !== "allow") rejectLaunch(decision.reason);

import os, requests

r = requests.post(
    "https://antivamp.io/api/v1/launches/validate",
    headers={
        "Authorization": f"Bearer {os.environ['ANTIVAMP_API_KEY']}",
        "Idempotency-Key": launch_attempt_id,
    },
    json={
        "chain": "hyperliquid",
        "launchpad": "your-launchpad",
        "name": name, "ticker": ticker, "launcher": launcher,
        "nonce": launch_attempt_id,
    },
    timeout=8,
)
r.raise_for_status()  # fail closed on any error
decision = r.json()
assert decision["decision"] == "allow", decision["reason"]

import { createHmac, timingSafeEqual } from "node:crypto";

// Decision signature: HMAC-SHA256 over this exact canonical string,
// keyed with the signing secret issued alongside your API key.
function verifyDecision(secret: string, d: DecisionResponse): boolean {
  const payload = [
    "antivamp.decision.v1",
    d.identityKey,
    d.chain,             // the chain you sent in the request
    d.launcher.toLowerCase(),
    d.decision,
    d.issuedAt,
    d.expiresAt,
    d.nonce,
    d.responseVersion,
  ].join("\n");
  const expected = createHmac("sha256", secret).update(payload).digest("hex");
  const fresh = new Date(d.expiresAt).getTime() > Date.now();
  return fresh && timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(d.signature, "hex"),
  );
}

// Header: X-AntiVamp-Signature: t=1789544400,v1=<hex>
// Signature: HMAC-SHA256(secret, `${t}.${rawBody}`)
import { createHmac, timingSafeEqual } from "node:crypto";

function verifyWebhook(secret: string, rawBody: string, header: string) {
  const { t, v1 } = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=")),
  );
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // 5 min tolerance
  const mac = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return timingSafeEqual(Buffer.from(mac, "hex"), Buffer.from(v1, "hex"));
}