Legacy GET mode

Legacy GET mode is a compatibility path for older vote-callback scripts that expect a plain GET request with the reward details in the query string, rather than a signed JSON POST. New integrations should use the default signed POST — it carries far more context (heart_id, period, streak_day) and is harder to forge.

When it fires

With Use legacy GET callback enabled on the Integration tab, a counted heart triggers a GET to your callback URL with three query params appended:

GET https://your-server.example/callback?username=<name>&ts=<unix>&sig=<hex>

There is no request body and no X-MMOLove-Signature header in legacy mode — the signature is the sig query param, and it's computed differently from the POST signature (see below).

The legacy signature

The legacy sig is an HMAC-SHA256 over "<username>|<ts>" — the username, a literal pipe (|), then the timestamp — in lower-case hex:

sig = HMAC_SHA256(secret, username + "|" + ts)   // lower-case hex

Verifying a legacy callback

Recompute the MAC from the username + ts query params and compare it constant-time to sig:

<?php
$username = $_GET['username'] ?? '';
$ts       = $_GET['ts'] ?? '';
$sig      = $_GET['sig'] ?? '';

$expected = hash_hmac('sha256', $username . '|' . $ts, $SECRET);  // lower-case hex
if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit;
}
// (Recommended) reject if abs(time() - (int)$ts) is more than a few minutes.
grant_reward($username);
http_response_code(200);

What you return

Same as the POST callback: return a 2xx once you've accepted the vote and MMOLove marks the delivery delivered; any non-2xx (or timeout) is retried with backoff. See Errors, retries & delivery.

Legacy GET has no heart_id, so you can't dedupe on it. To keep retries safe, dedupe on a (username, ts) pair instead — the same delivery always carries the same ts.

Migrating off legacy GET

Moving to the signed POST callback is a clean upgrade:

See also