Webhooks

from flask import Flask, request
import hmac
import hashlib
import json

app = Flask(__name__)

def validate_signature(payload, checksum, business_id):
  # Separate event and data
  event = payload['event']
  data = json.dumps(payload['data'])
  message = f"{event}|{data}"

  # Create HMAC SHA256 hash
  expected = hmac.new(
    business_id.encode('utf-8'),
    message.encode('utf-8'),
    hashlib.sha256
  ).hexdigest().upper()

  return hmac.compare_digest(expected, checksum)

@app.route('/webhook', methods=['POST'])
def handle_webhook():
  payload = request.json
  checksum = payload.get('checksum')
  business_id = 'YOUR_BUSINESS_ID'

  # Validate webhook signature
  if not validate_signature(payload, checksum, business_id):
    return 'Invalid signature', 401

  # Process the webhook event
  event_type = payload.get('event')
  if event_type == 'payment.session.succeeded':
    handle_successful_payment(payload['data'])
  elif event_type == 'payment.session.failed':
    handle_failed_payment(payload['data'])

  # Return 200 to acknowledge receipt
  return 'Webhook received', 200

import crypto from "crypto";
import express from "express";
import stringify from "json-stable-stringify";

const app = express();
app.use(express.json());

function validateSignature(payload, checksum, businessId) {
  const { event, data } = payload;

  const stringData = JSON.stringify(data);
  const message = `${event}|${stringData}`;

  // Create HMAC SHA256 hash
  const expectedChecksum = crypto
    .createHmac("sha256", businessId)
    .update(message)
    .digest("hex")
    .toUpperCase();

  return crypto.timingSafeEqual(
    Buffer.from(expectedChecksum),
    Buffer.from(checksum),
  );
}

app.post("/webhook", (req, res) => {
  const payload = req.body;
  const checksum = payload.checksum;
  const businessId = "YOUR_BUSINESS_ID";

  // Validate webhook signature
  if (!validateSignature(payload, checksum, businessId)) {
    return res.status(401).send("Invalid signature");
  }

  // Process webhook event
  const eventType = payload.event;
  switch (eventType) {
    case "payment.session.succeeded":
      handleSuccessfulPayment(payload.data);
      break;
    case "payment.session.failed":
      handleFailedPayment(payload.data);
      break;
  }

  // Acknowledge receipt
  res.status(200).send("Webhook received");
});

<?php

function validate_signature($payload, string $checksum, string $business_id): bool
{
    $event = $payload->event;
    $data = json_encode($payload->data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    $message = $event . '|' . $data;

    $expected = strtolower(hash_hmac('sha256', $message, $business_id));
    $checksum = strtolower($checksum);

    return hash_equals($expected, $checksum);
}

$data = file_get_contents('php://input');
$payload = json_decode($data);
$checksum = $payload->checksum;
$business_id = '<business-id>';

// Validate webhook signature
if (!validate_signature($payload, $checksum, $business_id)) {
    http_response_code(401);
    echo 'Invalid signature' . "\n";
    exit;
}

// Process webhook event
$eventType = $payload->event;
switch($eventType) {
  case 'payment.session.succeeded':
    handleSuccessfulPayment($payload->data->);
    break;
  case 'payment.session.failed':
    handleFailedPayment($payload->data);
    break;
}

// Acknowledge receipt
http_response_code(200);
echo 'Webhook received';