Quickstart

const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

app.post('/webhooks/fossapay', (req, res) => {
  // 1. Verify webhook signature
  const signature = req.headers['x-fossapay-signature'];
  const isValid = verifySignature(req.body, signature);

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  // 2. Respond immediately
  res.status(200).send('Webhook received');

  // 3. Process the webhook
  const { event, data } = req.body;

  if (event === 'payment.received') {
    console.log('Payment received!');
    console.log('Amount:', data.amount);
    console.log('From:', data.sender_name);
    console.log('Transaction ID:', data.transaction_id);

    // Credit user wallet, update database, send notification, etc.
    creditUserWallet(data.metadata.customer_id, data.amount);
  }
});

function verifySignature(payload, signature) {
  const secret = process.env.FOSSAPAY_WEBHOOK_SECRET;
  const hash = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');

  return hash === signature;
}

app.listen(3000, () => {
  console.log('Webhook server running on port 3000');
});

from flask import Flask, request
import hmac
import hashlib
import json
import os

app = Flask(__name__)

@app.route('/webhooks/fossapay', methods=['POST'])
def handle_webhook():
    # 1. Verify signature
    signature = request.headers.get('X-FossaPay-Signature')
    is_valid = verify_signature(request.data, signature)

    if not is_valid:
        return 'Invalid signature', 401

    # 2. Respond immediately
    payload = request.json

    # 3. Process webhook
    event = payload['event']
    data = payload['data']

    if event == 'payment.received':
        print('Payment received!')
        print(f'Amount: {data["amount"]}')
        print(f'From: {data["sender_name"]}')
        print(f'Transaction ID: {data["transaction_id"]}')

        # Credit user wallet, update database, etc.
        credit_user_wallet(data['metadata']['user_id'], data['amount'])

    return 'Webhook received', 200

def verify_signature(payload, signature):
    secret = os.environ['FOSSAPAY_WEBHOOK_SECRET']
    hash = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(hash, signature)

if __name__ == '__main__':
    app.run(port=3000)