A provably fair draw anyone can verify
Commit to a server seed before the draw, publish it after, and let any user reproduce the result themselves. The scheme, and the mistake that makes it worthless.
Tagged “hmac”
6 entries
Verify a Coinbase Commerce webhook
HMAC-SHA256 of the raw body against the X-CC-Webhook-Signature header, and the event types that actually mean money arrived.
Create a NOWPayments invoice and handle the callback
An API key on the way out, a signed and key-sorted JSON payload on the way back. The sorting requirement is the part that trips people.
Verify a CoinPayments IPN before you credit it
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
Enforce a minimum dwell that a script cannot skip
The countdown belongs to the client, so the client will lie. Bind the timing to a signed server token and check it when the claim arrives.
Only count an impression a real browser actually rendered
Crediting on the ad request pays anything that can run curl. A signed nonce plus a beacon that only fires in a visible browser closes it.