Webhooks

curl -X POST https://api-sandbox.sohopay.xyz/v1/webhooks \
  -H "Authorization: Bearer $SOHOPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: webhook-settlements-v1" \
  -d '{
    "url": "https://example.com/sohopay/webhooks",
    "events": ["payment.settled", "payment.failed", "merchant.settlement.completed", "merchant.kyb.approved"]
  }'

const webhook = await sohopay.webhooks.create({
  url: "https://example.com/sohopay/webhooks",
  events: ["payment.settled", "payment.failed", "merchant.settlement.completed", "merchant.kyb.approved"],
});
console.log(webhook.secret); // shown ONCE — store it now

webhook = sohopay.webhooks.create(
    url="https://example.com/sohopay/webhooks",
    events=["payment.settled", "payment.failed", "merchant.settlement.completed", "merchant.kyb.approved"],
)
print(webhook.secret)  # shown ONCE — store it now

import express from "express";
import crypto from "node:crypto";

const app = express();
const SECRET = process.env.SOHOPAY_WEBHOOK_SECRET!;

// Raw body is required — JSON re-serialization would break the signature.
app.post(
  "/sohopay/webhooks",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("Sohopay-Signature") ?? "";
    const timestamp = req.header("Sohopay-Timestamp") ?? "";

    // Reject stale deliveries (replay protection)
    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
      return res.status(400).send("timestamp too old");
    }

    const expected = crypto
      .createHmac("sha256", SECRET)
      .update(`${timestamp}.${req.body.toString("utf8")}`)
      .digest("hex");
    const a = Buffer.from(signature, "hex");
    const b = Buffer.from(expected, "hex");
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).send("invalid signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    res.status(200).send("ok"); // ack first, process async
    queueForProcessing(event); // dedupe by event.event_id
  }
);

import hashlib, hmac, json, os, time
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["SOHOPAY_WEBHOOK_SECRET"]


@app.post("/sohopay/webhooks")
def sohopay_webhook():
    signature = request.headers.get("Sohopay-Signature", "")
    timestamp = request.headers.get("Sohopay-Timestamp", "")

    # Reject stale deliveries (replay protection)
    if abs(time.time() - float(timestamp or 0)) > 300:
        return "timestamp too old", 400

    # Sign over the RAW body, not re-serialized JSON
    body = request.get_data(as_text=True)
    expected = hmac.new(
        SECRET.encode(), f"{timestamp}.{body}".encode(), hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        return "invalid signature", 401

    event = json.loads(body)
    queue_for_processing(event)  # dedupe by event["event_id"]
    return "ok", 200  # ack fast, process async