v22.2
Notifuse/notifusev22.2Dec 31, 2025by pierre-b
AI Summary
Notifuse v22.2 introduces programmatic root authentication via a new `/api/user.rootSignin` endpoint, enabling automated authentication for CI/CD pipelines, Infrastructure-as-Code deployments, and automated testing. The feature uses HMAC-SHA256 signatures with replay attack protection and rate limiting for security.
Key Highlights
- New `/api/user.rootSignin` endpoint for programmatic authentication
- HMAC-SHA256 signature using existing SECRET_KEY
- 60-second timestamp window prevents replay attacks
- Rate limited to 5 attempts per 5 minutes
- Only works for configured ROOT_EMAIL for security
New Features
- Programmatic root authentication endpoint (`/api/user.rootSignin`) for CI/CD and automated workflows
- HMAC-SHA256 signature-based authentication
- Replay attack prevention via timestamp validation
- Rate limiting protection (5 attempts per 5 minutes)
Full Release Notes
# Release Notes v22.2
## Programmatic Root Authentication
New `/api/user.rootSignin` endpoint enables automated authentication for CI/CD pipelines, Infrastructure-as-Code deployments, and automated testing.
Docs: https://docs.notifuse.com/installation#programmatic-authentication
### Usage
```bash
SECRET_KEY="your-secret-key"
ROOT_EMAIL="admin@example.com"
TIMESTAMP=$(date +%s)
MESSAGE="${ROOT_EMAIL}:${TIMESTAMP}"
SIGNATURE=$(echo -n "$MESSAGE" | openssl dgst -sha256 -hmac "$SECRET_KEY" | awk '{print $2}')
curl -X POST https://your-instance.com/api/user.rootSignin \
-H "Content-Type: application/json" \
-d "{\"email\":\"${ROOT_EMAIL}\",\"timestamp\":${TIMESTAMP},\"signature\":\"${SIGNATURE}\"}"
```
### Security
- HMAC-SHA256 signature using existing `SECRET_KEY`
- 60-second timestamp window prevents replay attacks
- Rate limited: 5 attempts per 5 minutes
- Only works for configured `ROOT_EMAIL`