Webhooks

import crypto from 'node:crypto';

function verifyWebhook(req, rawBody) {
const timestamp = req.header('x-azpay-timestamp');
const signature = req.header('x-azpay-signature');
const path = '/azpay/webhook';
const canonical = [timestamp, 'POST', path, rawBody, process.env.AZPAY_HASH_SECRET].join('.');
const expected = crypto.createHmac('sha256', process.env.AZPAY_API_SECRET).update(canonical).digest('hex');
return crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'));
}

app.post('/azpay/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
const rawBody = req.body.toString('utf8');
if (!verifyWebhook(req, rawBody)) return res.sendStatus(401);
const payload = JSON.parse(rawBody);
if (payload.status === 'approved') await applySettlement(payload);
res.sendStatus(200);
});

<?php
$rawBody = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_AZPAY_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_AZPAY_SIGNATURE'] ?? '';
$path = '/azpay/webhook';
$canonical = implode('.', [$timestamp, 'POST', $path, $rawBody, getenv('AZPAY_HASH_SECRET')]);
$expected = hash_hmac('sha256', $canonical, getenv('AZPAY_API_SECRET'));

if (!hash_equals($expected, $signature)) {
  http_response_code(401);
  exit;
}
$payload = json_decode($rawBody, true);
if ($payload['status'] === 'approved') {
  applySettlement($payload);
}
http_response_code(200);