# Server helpers

> Sign user tokens and verify webhooks with one function call in Node, PHP, Python or Go, and drive the Partner API.

Source: https://docs.nexafone.so/v1/server/

Your server does three things for a Nexafon integration, and each helper does each in one call, with no dependencies
beyond the language’s standard library:

| Task | Node | PHP | Python | Go |
| --- | --- | --- | --- | --- |
| Sign a user token | `createUserToken` | `Tokens::createUserToken` | `create_user_token` | `CreateUserToken` |
| Sign a partner user token | `createPartnerUserToken` | `Tokens::createPartnerUserToken` | `create_partner_user_token` | `CreatePartnerUserToken` |
| Verify a webhook | `verifyWebhook` | `Webhook::verify` | `verify_webhook` | `VerifyWebhook` |
| Partner API client | `PartnerClient` | `PartnerClient` | `PartnerClient` | `NewPartnerClient` |
| Package | `@nexafon/node` (npm) | `nexafon/nexafon-php` (Composer) | `nexafon` (PyPI) | `github.com/Keyd-Solutions/nexafon/packages/server-go` |
| Runtime | Node 20.19+ | PHP 8.1+ with ext-curl | Python 3.9+ | Go 1.22+ |

:::note[Not published yet]
The Nexafon packages are not on npm, Packagist or PyPI yet, and `go get` finds the Go module only once the Nexafon
repository is public and tagged, so installing them by name fails for now. Until then,
[install them from a checkout of the repo](/v1/quickstart/#install-from-a-checkout). The install commands shown here
are the ones to use after release.
:::

Tokens from every helper carry the same claims, and the same webhook fixtures verify in all four; Nexafon’s CI checks
both against the real API.

Guides: [Node](/v1/server/node/), [PHP](/v1/server/php/), [Python](/v1/server/python/), [Go](/v1/server/go/).
Another language? A user token is a plain HS256 JWT: [user tokens](/v1/server/user-tokens/) describes it, and
[signatures](/v1/webhooks/signatures/) the webhook check.

## Configuration

| Variable | Read by | |
| --- | --- | --- |
| `NEXAFON_SECRET_KEY` | `createUserToken` | A workspace secret key (`sk_live_…`/`sk_test_…`) |
| `NEXAFON_PARTNER_SECRET_KEY` | partner tokens, `PartnerClient` | A partner secret key (`psk_live_…`/`psk_test_…`) |
| `NEXAFON_API_URL` | `PartnerClient` | The API origin, `https://api.nexafone.so` |

Each can also be passed explicitly. Keep secret keys in your server’s environment or secret store; never ship them
to a browser or an app.