Code Examples

Integration examples in multiple programming languages.

Submit Content for Review

Here's how to submit AI-generated content for review in different languages:

create_review.js
fetch('https://checkyour.ai/api/v1/reviews', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_API_TOKEN',
'Content-Type': 'application/json'
},
body: JSON.stringify({
'input': 'Customer asked: How do I return my order?',
'output': 'To return your order, visit our returns page at returns.example.com within 30 days of delivery.',
'context': 'VIP customer support inquiry',
'model': 'gpt-4',
'external_id': 'TICKET-1234',
'category': 'customer_support',
'review_focus': 'accuracy',
'language': 'en-US',
'confidence': 0.92,
'webhook_url': 'https://myapp.com/webhooks/review-completed',
'metadata': {
'ticket_id': '1234',
'customer_id': 'CUST-789'
}
})
});

Verify Webhook Signatures

Secure your webhook endpoints by verifying HMAC-SHA256 signatures. Here's the verification flow:

webhook-verification-flow
// 1. Extract signature and timestamp from webhook headers
signature = request.headers['X-CheckYourAI-Signature']
timestamp = request.headers['X-CheckYourAI-Timestamp']
// 2. Verify timestamp is recent (within 5 minutes)
current_time = current_unix_timestamp()
if (abs(current_time - timestamp) > 300) {
return error("Webhook timestamp too old")
}
// 3. Construct the signed payload
signed_payload = timestamp + "." + request.body
// 4. Compute HMAC-SHA256 signature
expected_signature = hmac_sha256(
key: YOUR_WEBHOOK_SECRET,
message: signed_payload
)
// 5. Compare signatures (use constant-time comparison!)
if (!constant_time_compare(signature, expected_signature)) {
return error("Invalid webhook signature")
}
// 6. Signature is valid - process webhook safely
process_webhook(request.body)

Implementation Notes:

  • Timestamp validation: Prevents replay attacks by rejecting old webhooks
  • Constant-time comparison: Prevents timing attacks when comparing signatures
  • HMAC-SHA256: Use your language's crypto library (crypto in Node.js, hashlib in Python, etc.)

Always verify webhook signatures!

Without signature verification, attackers could send fake review results to your webhook endpoint.

Environment Variables

For API Requests

Store your API credentials securely using environment variables:

CHECKYOURAI_API_TOKEN="cya_your_token_here")
CHECKYOURAI_WEBHOOK_SECRET="cya_whs_your_secret_here"

Pro tip: Use a .env file with a library like dotenv (Node.js/Python) or dotenvy (Elixir).

Error Handling Best Practices

Always Check Status Codes

Handle different HTTP status codes appropriately:

  • 201 - Success
  • 401 - Check your API token
  • 422 - Validation error, check request body
  • 429 - Rate limited, use Retry-After header

Implement Retries for 429

When rate limited, respect the Retry-After header and implement exponential backoff for retries.

Log Errors for Debugging

Always log the full error response body for troubleshooting. It includes detailed validation errors.

Testing Your Integration

Use Test API Tokens

Create separate API tokens for development, staging, and production environments.

Test Webhooks Locally

Use tools like ngrok or localtunnel to expose your local webhook endpoint for testing.

Next Steps