VerifyMySignal
Require authenticity, freshness, and first use before an external callback wakes an agent or advances a workflow.
Use it when
A webhook or cross-agent signal is untrusted until its shared-secret signature and timestamp pass.
Decision rule
Proceed only when accepted is true. Replayed nonces return first_seen: false.
HMAC input: timestamp + "." + nonce + "." + message POST /v1/signals/verify
The message and shared secret are processed in memory and are not stored. Use a separate high-entropy secret for each sender relationship.