Webhooks

{
  "id": "evt_550e8400-e29b-41d4-a716-446655440000",
  "object": "event",
  "type": "payment.capture.completed",
  "created": 1717406400,
  "data": {
    "id": "txn_01HQXYZ",
    "amount": "25.0000",
    "net": "24.1300",
    "currency": "USD",
    "status": "completed"
  }
}

Watenga-Signature: t=1717406400,v1=5257a869e7ec3ead4f1b0f8b5b1f8b6f9f0c2e1d3a4b5c6d7e8f9a0b1c2d3e4f

const crypto = require('crypto');

// Watenga signs every delivery with the 'Watenga-Signature' header:
//   t=<unix-seconds>,v1=<hmac-sha256-hex>
// where v1 = HMAC_SHA256(secret, `${t}.${rawBody}`)
const header = req.headers['watenga-signature'] || '';
const parts = Object.fromEntries(
  header.split(',').map((kv) => kv.split('=').map((s) => s.trim())),
);
const timestamp = Number(parts.t);
const signature = parts.v1 || '';

// Reject replays older than 5 minutes (300s tolerance).
if (!Number.isFinite(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > 300) {
  throw new Error('Webhook timestamp outside tolerance window');
}

const expected = crypto
  .createHmac('sha256', process.env.WATENGA_WEBHOOK_SECRET)
  .update(`${timestamp}.${req.rawBody}`, 'utf8')
  .digest('hex');

const a = Buffer.from(signature);
const b = Buffer.from(expected);
if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
  throw new Error('Invalid signature');
}

// Envelope: { id, object: 'event', type, created, data }
const event = JSON.parse(req.rawBody);
if (event.type === 'payment.capture.completed') {
  // fulfil the order — event.data holds the transaction
}

$header = $_SERVER['HTTP_WATENGA_SIGNATURE'] ?? '';
$parts = [];
foreach (explode(',', $header) as $segment) {
    [$k, $v] = array_pad(explode('=', $segment, 2), 2, '');
    $parts[trim($k)] = trim($v);
}
$timestamp = (int) ($parts['t'] ?? 0);
$signature = $parts['v1'] ?? '';

// Reject replays older than 5 minutes (300s tolerance).
if (abs(time() - $timestamp) > 300) {
    http_response_code(400);
    exit('Timestamp outside tolerance window');
}

$rawBody = file_get_contents('php://input');
$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, getenv('WATENGA_WEBHOOK_SECRET'));

if (!hash_equals($expected, $signature)) {
    http_response_code(400);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
// $event['type'] === 'payment.capture.completed'