Security

import os
import requests

# Good: load the key from the environment
API_KEY = os.environ["TORK_API_KEY"]

# Bad: hardcoded key
# API_KEY = "tork_sk_..."  # Never do this!

resp = requests.post(
    "https://tork.network/api/v1/govern",
    headers={
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json",
    },
    json={"input": "Contact me at jane@example.com"},
    timeout=10,
)
resp.raise_for_status()

# Configure the IP allowlist in the dashboard:
#   Settings > Security > IP Allowlist
#
# Allowlisting is enforced by the Tork cloud API and applies to
# requests that carry your API key. The on-device SDK is unaffected:
# with no API key it makes no network calls at all.
#
# Verify which source IP the API sees from a given host:
import os
import requests

resp = requests.get(
    "https://tork.network/api/v1/health",
    headers={"Authorization": f"Bearer {os.environ['TORK_API_KEY']}"},
    timeout=10,
)
print(resp.status_code)  # 403 if this host is not on the allowlist

import hmac
import hashlib
from datetime import datetime, timedelta

def verify_webhook(payload: bytes, signature: str, timestamp: str, secret: str) -> bool:
    # Check timestamp to prevent replay attacks
    webhook_time = datetime.fromisoformat(timestamp)
    if datetime.utcnow() - webhook_time > timedelta(minutes=5):
        return False

    # Verify HMAC signature
    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.{payload.decode()}".encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, f"sha256={expected}")

Responsible Disclosure

Please report security vulnerabilities to:

security@tork.network

We respond to all reports within 24 hours and aim to resolve critical issues within 72 hours.