Webhooks Overview

{
  "event": "deposit.completed",
  "event_id": "evt_abc123",
  "timestamp": "2024-01-15T10:30:45Z",
  "data": {
    // Event-specific data
  },
  "business_id": "bus_your_business"
}

curl -X PUT https://api-production.fossapay.com/api/v1/settings/webhooks \
  -H "Authorization: Bearer fp_live_sk_xxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/fossapay",
    "events": [
      "deposit.completed",
      "withdrawal.completed",
      "transfer.completed",
      "transfer.failed",
      "wallet.balance.updated"
    ],
    "secret": "your-webhook-secret"
  }'

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const hash = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');

  return hash === signature;
}

app.post('/webhooks/fossapay', (req, res) => {
  const signature = req.headers['x-fossapay-signature'];

  if (!verifyWebhook(req.body, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  res.status(200).send('OK');
  processWebhook(req.body);
});

ngrok http 3000