Webhooks Overview

{
  "eventId": "evt_mtwc9i1y_0409d781714d8fa2",
  "eventType": "checkout.completed",
  "data": {
    "checkoutId": "35f5f6fb-0c8d-4e96-ba4a-c04750724ff6",
    "reference": "ORDER-10025",
    "status": "completed"
  },
  "timestamp": "2026-09-11T02:30:14.186Z"
}

signature = HMAC-SHA256(webhook_secret, JSON.stringify(body.data))

import crypto from 'node:crypto';
import express from 'express';

const app = express();
app.use(express.json());

function verifyWebhook(body, signature, secret) {
  if (!body || !body.data || !signature || !secret) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(body.data))
    .digest('hex');

  const received = String(signature);
  if (expected.length !== received.length) return false;

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'utf8'),
    Buffer.from(received, 'utf8')
  );
}

app.post('/webhooks/fossapay', (req, res) => {
  const signature = req.get('x-fossapay-signature');

  if (!verifyWebhook(req.body, signature, process.env.FOSSAPAY_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  res.sendStatus(200);
  enqueueWebhook(req.body);
});

import hashlib
import hmac
import json

def verify_webhook(body, received_signature, secret):
    serialized_data = json.dumps(
        body["data"],
        separators=(",", ":"),
        ensure_ascii=False,
    )
    expected = hmac.new(
        secret.encode("utf-8"),
        serialized_data.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, received_signature)

ngrok http 3000