Webhooks

POST /hooks/anonpay HTTP/1.1
Host: shop.example
Content-Type: application/json
User-Agent: apa-hooker/3
X-Event: completed
X-Signature: t=1753920000,v1=5f0d0a1c8b7e3d2f4a6b9c1e0d3f5a7b9c2e4f6a8b0d1c3e5f7a9b2c4d6e8f0a

{"event":"completed","payment":{"address":"bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq","confirmations":6,"confirmations_needed":6,"currency":"btc","paid":"0.00021","rate":"0.0000105","topay":"0.00021"},"private_key":"a3f9d0e1c2b4a6f8e0d2c4b6a8f0e2d4","timestamp":1753920000,"transaction_id":"9c1f0b7a4e2d8f6a3b5c7d9e1f0a2b4c"}

import hashlib
import hmac
import time


def verify(secret: str, header: str, body: bytes) -> bool:
    try:
        parts = dict(p.split("=", 1) for p in header.split(","))
        timestamp, signature = int(parts["t"]), parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - timestamp) > 300:
        return False
    signed = f"{timestamp}.".encode() + body
    digest = hmac.new(secret.encode(), signed, hashlib.sha256)
    return hmac.compare_digest(digest.hexdigest(), signature)

import crypto from "node:crypto";

export function verify(secret, header, body) {
  const parts = Object.fromEntries(
    header.split(",").map((part) => part.split("=", 2)),
  );
  const timestamp = Number(parts.t);
  if (!parts.v1 || !Number.isInteger(timestamp)) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(body)
    .digest("hex");
  return expected.length === parts.v1.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

function verify(string $secret, string $header, string $body): bool
{
    $parts = [];
    foreach (explode(",", $header) as $part) {
        [$key, $value] = array_pad(explode("=", $part, 2), 2, "");
        $parts[$key] = $value;
    }
    if (!isset($parts["t"], $parts["v1"]) || !ctype_digit($parts["t"])) {
        return false;
    }
    if (abs(time() - (int) $parts["t"]) > 300) {
        return false;
    }
    $expected = hash_hmac("sha256", $parts["t"] . "." . $body, $secret);
    return hash_equals($expected, $parts["v1"]);
}