How it works, and how to build against it.

import crypto from 'node:crypto';

// AtTable-Signature: t=<unix>,v1=<hex>
export function verify(rawBody, header, secret) {
  const { t, v1 = '' } = Object.fromEntries(
    String(header ?? '').split(',').map((kv) => kv.split('='))
  );
  const ts = Number(t);
  if (!ts || Math.abs(Date.now() / 1000 - ts) > 300) return false;

  const mac = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`) // the raw bytes, not re-serialised JSON
    .digest('hex');
  const a = Buffer.from(v1);
  const b = Buffer.from(mac);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}