Coffrify — Ruby SDK

Official Ruby SDK for Coffrify, encrypted file transfer infrastructure.

Pure stdlib (net/http, openssl, json). Zero runtime dependencies. Requires Ruby 2.7+.

Install

gem install coffrify
# or in a Gemfile:
#   gem "coffrify", "~> 0.1"

Quickstart

require "coffrify"

coffrify = Coffrify::Client.new(api_key: ENV.fetch("COFFRIFY_API_KEY"))

# Create a transfer
transfer = coffrify.transfers.create(
  [{ name: "rapport.pdf", size: 1_240_000, mime_type: "application/pdf" }],
  expires_in_hours: 72,
  max_downloads: 10,
  password: "s3cret!",
)
puts transfer["share_url"]

# List
puts coffrify.transfers.list(limit: 5)

# Webhooks
hook = coffrify.webhooks.create(
  name: "Production hook",
  url: "https://app.example.com/hooks/coffrify",
  events: ["transfer.created", "transfer.downloaded", "transfer.scan_infected"],
)
puts "Save this secret: #{hook['secret']}"

# Catalog of every supported event
coffrify.webhooks.events["data"].each { |e| puts "#{e['type']} (#{e['family']})" }

Webhook signature verification

require "sinatra"
require "coffrify"

post "/hooks/coffrify" do
  raw = request.body.read
  sig = request.env["HTTP_X_COFFRIFY_SIGNATURE"]
  v   = Coffrify::Webhook.verify(raw, sig, ENV.fetch("COFFRIFY_WEBHOOK_SECRET"))
  halt 400, v[:reason] unless v[:valid]

  case v[:event]["type"]
  when "transfer.downloaded" then handle_download(v[:event])
  when "transfer.scan_infected" then quarantine!(v[:event])
  end
  status 200
end

The header has the form t=<timestamp>,v1=<hmac_hex>. Verification:

1. Confirms the timestamp is within ±5 minutes (replay protection).
2. Recomputes HMAC-SHA256(secret, "<timestamp>.<raw_body>") in constant time.

API key rotation

result = coffrify.api_keys.rotate("ak_…", grace_days: 7)
puts "New key (save now): #{result['new_key']}"
puts "Old key auto-revokes at: #{result['grace_until']}"

License

MIT.