Webhooks

# Example: Flask endpoint
@app.route('/webhooks/moneybag', methods=['POST'])
def handle_webhook():
    # Verify signature (see Signature Verification section)
    # Process event
    return '', 200

Content-Type: application/json
X-Webhook-Signature: sha256=<hmac_signature>
X-Webhook-Timestamp: 1701345600
X-Webhook-Event-Type: payment.success
X-Webhook-Event-Id: 550e8400-e29b-41d4-a716-446655440000
User-Agent: MoneyBag-Webhooks/1.0

{
  "event_id": "550e8400-e29b-41d4-a716-446655440000",
  "event_type": "payment.success",
  "occurred_at": "2025-11-30T10:30:00Z",
  "merchant_id": 123,
  "data": {
    "transaction_id": "TXN123456789",
    "amount": 1000.00,
    "currency": "BDT",
    "customer": {
      "name": "John Doe",
      "email": "john@example.com",
      "phone": "+880123456789"
    },
    "payment_method": "bKash",
    "reference": "ORDER-001"
  }
}

import hmac
import hashlib
import time

def verify_webhook_signature(payload_body, signature_header, timestamp_header, secret_key):
    """
    Verify MoneyBag webhook signature.

    Args:
        payload_body: Raw request body (string)
        signature_header: X-Webhook-Signature header value
        timestamp_header: X-Webhook-Timestamp header value
        secret_key: Your webhook secret key (whsec_...)

    Returns:
        bool: True if signature is valid
    """
    # Check timestamp (reject if > 5 minutes old)
    try:
        timestamp = int(timestamp_header)
        if abs(time.time() - timestamp) > 300:
            return False
    except (ValueError, TypeError):
        return False

    # Construct signed message
    signed_message = f"{timestamp_header}.{payload_body}"

    # Calculate expected signature
    expected = hmac.new(
        key=secret_key.encode('utf-8'),
        msg=signed_message.encode('utf-8'),
        digestmod=hashlib.sha256
    ).hexdigest()

    expected_header = f"sha256={expected}"

    # Constant-time comparison
    return hmac.compare_digest(expected_header, signature_header)

const crypto = require('crypto');

function verifyWebhookSignature(payloadBody, signatureHeader, timestampHeader, secretKey) {
  // Check timestamp (reject if > 5 minutes old)
  const timestamp = parseInt(timestampHeader, 10);
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - timestamp) > 300) {
    return false;
  }

  // Construct signed message
  const signedMessage = `${timestampHeader}.${payloadBody}`;

  // Calculate expected signature
  const expected = crypto
    .createHmac('sha256', secretKey)
    .update(signedMessage)
    .digest('hex');

  const expectedHeader = `sha256=${expected}`;

  // Constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(expectedHeader),
    Buffer.from(signatureHeader)
  );
}

function verifyWebhookSignature($payloadBody, $signatureHeader, $timestampHeader, $secretKey) {
    // Check timestamp (reject if > 5 minutes old)
    $timestamp = intval($timestampHeader);
    $currentTime = time();
    if (abs($currentTime - $timestamp) > 300) {
        return false;
    }

    // Construct signed message
    $signedMessage = $timestampHeader . '.' . $payloadBody;

    // Calculate expected signature
    $expected = 'sha256=' . hash_hmac('sha256', $signedMessage, $secretKey);

    // Constant-time comparison
    return hash_equals($expected, $signatureHeader);
}

from flask import Flask, request, jsonify
import hmac
import hashlib
import time
import json
import os

app = Flask(__name__)
WEBHOOK_SECRET = os.environ.get('MONEYBAG_WEBHOOK_SECRET')

@app.route('/webhooks/moneybag', methods=['POST'])
def handle_moneybag_webhook():
    # Get headers
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = request.headers.get('X-Webhook-Timestamp')
    event_type = request.headers.get('X-Webhook-Event-Type')
    event_id = request.headers.get('X-Webhook-Event-Id')

    if not all([signature, timestamp, event_type, event_id]):
        return jsonify({'error': 'Missing headers'}), 400

    # Get raw body BEFORE parsing JSON
    payload_body = request.get_data(as_text=True)

    # Verify signature
    if not verify_webhook_signature(payload_body, signature, timestamp, WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    # Parse payload
    data = json.loads(payload_body)

    # Handle event (use idempotency check with event_id)
    if event_type == 'payment.success':
        handle_payment_success(data)
    elif event_type == 'payment.failed':
        handle_payment_failed(data)
    elif event_type == 'subscription.payment_succeeded':
        handle_subscription_renewal(data)

    return '', 200

def handle_payment_success(data):
    transaction_id = data['data']['transaction_id']
    amount = data['data']['amount']
    print(f"Payment {transaction_id} succeeded: {amount} BDT")

def handle_payment_failed(data):
    transaction_id = data['data']['transaction_id']
    print(f"Payment {transaction_id} failed")

def handle_subscription_renewal(data):
    subscription_id = data['data']['subscription_uuid']
    print(f"Subscription {subscription_id} renewed")

const express = require('express');
const crypto = require('crypto');

const app = express();
const WEBHOOK_SECRET = process.env.MONEYBAG_WEBHOOK_SECRET;

// Use raw body for signature verification
app.post('/webhooks/moneybag',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-webhook-signature'];
    const timestamp = req.headers['x-webhook-timestamp'];
    const eventType = req.headers['x-webhook-event-type'];
    const eventId = req.headers['x-webhook-event-id'];

    if (!signature || !timestamp || !eventType || !eventId) {
      return res.status(400).json({ error: 'Missing headers' });
    }

    const payloadBody = req.body.toString();

    if (!verifyWebhookSignature(payloadBody, signature, timestamp, WEBHOOK_SECRET)) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const data = JSON.parse(payloadBody);

    // Handle event
    switch (eventType) {
      case 'payment.success':
        handlePaymentSuccess(data);
        break;
      case 'payment.failed':
        handlePaymentFailed(data);
        break;
      case 'subscription.payment_succeeded':
        handleSubscriptionRenewal(data);
        break;
    }

    res.status(200).end();
  }
);

function handlePaymentSuccess(data) {
  const { transaction_id, amount } = data.data;
  console.log(`Payment ${transaction_id} succeeded: ${amount} BDT`);
}

function handlePaymentFailed(data) {
  const { transaction_id } = data.data;
  console.log(`Payment ${transaction_id} failed`);
}

function handleSubscriptionRenewal(data) {
  const { subscription_uuid } = data.data;
  console.log(`Subscription ${subscription_uuid} renewed`);
}

@app.route('/webhooks/moneybag', methods=['POST'])
def webhook():
    # Verify signature...

    # Queue for async processing
    queue.enqueue(process_webhook, data)

    # Return immediately
    return '', 200

def handle_webhook(data):
    event_id = data['event_id']

    # Check if already processed
    if is_event_processed(event_id):
        return  # Skip duplicate

    # Process event
    process_event(data)

    # Mark as processed
    mark_event_processed(event_id)

def handle_webhook(data, raw_body):
    save_webhook_log(
        event_id=data['event_id'],
        event_type=data['event_type'],
        raw_payload=raw_body,
        received_at=datetime.now()
    )

handlers = {
    'payment.success': handle_payment_success,
    'payment.failed': handle_payment_failed,
    # ... other handlers
}

handler = handlers.get(event_type, handle_unknown_event)
handler(data)