Verify a Signed link

This page is for admins who make Buttons.

A Link button with a Signed link adds a token to the URL. The token tells the target page which Pipedrive user clicked the Button. In this guide, you verify the token on a Node.js server.

You need:

• A Link button with a Signed link.
• The signing secret of the Button.
• Node.js 18 or later on your server.

Verify the token with the crypto module

This function uses only the built-in crypto module. It returns the claims of a valid token, or null. The code uses import and export, so set "type": "module" in package.json or use a .mjs file.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyOneClickToken(token, secret) {
  const [header, payload, signature] = token.split('.');
  if (!header || !payload || !signature) return null;
  const { alg } = JSON.parse(Buffer.from(header, 'base64url').toString());
  if (alg !== 'HS256') return null;
  const key = Buffer.from(secret, 'base64url');
  const expected = createHmac('sha256', key).update(`${header}.${payload}`).digest();
  const actual = Buffer.from(signature, 'base64url');
  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) return null;
  const claims = JSON.parse(Buffer.from(payload, 'base64url').toString());
  if (claims.exp <= Math.floor(Date.now() / 1000)) return null;
  return claims;
}

The function does the steps in Verify the token on the target page. It uses the decoded bytes of the secret as the key, not the text of the secret.

Verify the token with a JWT library

With a JWT library, give the decoded bytes of the secret as the key. For example, with jsonwebtoken:

jwt.verify(token, Buffer.from(secret, 'base64url'), { algorithms: ['HS256'] });

Use the claims

The claims tell the Pipedrive company and the Pipedrive user. For the list of the claims, see Verify the token on the target page.

Do not use the other values in the URL for access control, for example the ID of the deal. The token does not sign them.