create_owner

com.editalmd/editalmd · Verify this server

Creates the guest (token edm_…, issued by the account library) that opens alerts and watches, and the secret whsec_… that signs the webhooks. No sign-up. The token appears only once: keep it and send it in Authorization: Bearer in the alert and watch tools. The account library signs the token, with a limit per network and per hour, so the free allowance does not become infinite. The token has no recovery: sign in to the account and bring the lists into it (`POST /api/auth/claim`, which the account page does on sign-in) to stop depending on it. You can read `webhook_segredo` again in `GET /api/dono`. Each webhook POST carries `webhook-id`, `webhook-timestamp` (Unix seconds) and `webhook-signature: v1,<base64>`: HMAC-SHA256 of `id.timestamp.body` with the key of your `whsec_…` (the base64 after the prefix). This is the Standard Webhooks pattern: any of its libraries can check it; reject a timestamp outside 5 minutes. After `POST /api/dono/segredo`, the previous secret still signs for 24 h (two `v1,` parts in the header).