Webhook Implementation

import express from 'express';
import crypto from 'crypto';

const app = express();

// CRITICAL: use raw body, not parsed JSON, so the HMAC matches
app.use('/webhooks/ntxpay', express.raw({ type: 'application/json' }));

const SECRET = process.env.NTXPAY_WEBHOOK_SECRET!;
const seen = new Set<string>(); // production: Redis with TTL

app.post('/webhooks/ntxpay', async (req, res) => {
  const sig = req.header('X-NTXPay-Signature') ?? '';
  const deliveryId = req.header('X-NTXPay-Delivery') ?? '';

  const expected = 'sha256=' + crypto
    .createHmac('sha256', SECRET)
    .update(req.body)
    .digest('hex');

  if (sig.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(401).end();
  }

  // Dedupe
  if (seen.has(deliveryId)) return res.json({ duplicate: true });
  seen.add(deliveryId);

  const event = JSON.parse(req.body.toString());

  // Process async — don't block the response
  enqueue(event).catch(console.error);

  res.json({ received: true });
});

import hmac
import hashlib
from flask import Flask, request, abort, jsonify

app = Flask(__name__)
SECRET = b'<your-webhook-secret>'
seen = set()  # production: Redis with TTL

@app.post('/webhooks/ntxpay')
def webhook():
    raw = request.get_data()  # raw bytes
    sig = request.headers.get('X-NTXPay-Signature', '')
    delivery_id = request.headers.get('X-NTXPay-Delivery', '')

    expected = 'sha256=' + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        abort(401)

    if delivery_id in seen:
        return jsonify(duplicate=True)
    seen.add(delivery_id)

    event = request.get_json()
    # enqueue asynchronously
    enqueue(event)

    return jsonify(received=True)

<?php
$secret = getenv('NTXPAY_WEBHOOK_SECRET');

$raw = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_NTXPAY_SIGNATURE'] ?? '';
$deliveryId = $_SERVER['HTTP_X_NTXPAY_DELIVERY'] ?? '';

$expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);

if (!hash_equals($signature, $expected)) {
    http_response_code(401);
    exit;
}

// Dedupe (use Redis in production)
if (isset($_SESSION['seen'][$deliveryId])) {
    echo json_encode(['duplicate' => true]);
    exit;
}
$_SESSION['seen'][$deliveryId] = true;

$event = json_decode($raw, true);

// Queue async processing
// processAsync($event);

http_response_code(200);
echo json_encode(['received' => true]);

const event = JSON.parse(req.body.toString());

switch (event.event) {
  case 'cash_in':
    if (event.transaction.status === 'CONFIRMED') {
      await markOrderPaid(event.transaction.externalId);
    }
    break;

  case 'cash_out':
    if (event.transaction.status === 'CONFIRMED') {
      await markPayoutSettled(event.transaction.id);
    } else if (event.transaction.status === 'FAILED') {
      await markPayoutFailed(event.transaction.id);
    }
    break;

  case 'refund_in':
  case 'refund_out':
    await processRefund(event);
    break;
}