Webhooks Documentation

// server.js
const express = require('express');
const crypto = require('crypto');
const app = express();

// Your webhook secret from the dashboard
const WEBHOOK_SECRET = 'your_webhook_secret'; // Get this from your dashboard

// Parse JSON bodies
app.use(express.json());

// Verify webhook signature
function verifySignature(data, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(data))
    .digest('hex');

  console.log('Expected Signature:', expectedSignature);
  console.log('Provided Signature:', signature);

  return signature === expectedSignature;
}

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const eventType = req.headers['x-webhook-event'];

  console.log('Received webhook:', {
    eventType,
    signature,
    payload: req.body,
  });

  // The signature is calculated on the data object only, not the entire payload
  const data = req.body.data;
  
  // Verify signature
  if (!verifySignature(data, signature, WEBHOOK_SECRET)) {
    console.log('Invalid signature');
    return res.status(400).json({ error: 'Invalid signature' });
  }

  console.log('Signature verified successfully!');

  // Handle different event types
  switch (req.body.type) {
    case 'payment.completed':
      const { paymentId, status, transaction } = req.body.data;
      console.log('Payment completed:', {
        paymentId,
        status,
        amount: transaction.amount,
        transactionId: transaction.id,
        transactionDate: transaction.createdAt,
      });
      
      // Update your database, send notifications, etc.
      // This should be handled asynchronously or with a job queue for production
      
      break;

    case 'payment.expired':
      console.log('Payment expired:', req.body.data);
      // Handle expired payment logic
      break;
      
    case 'account.created':
      // Handle new account logic
      break;
      
    // Handle other event types
    default:
      console.log('Unhandled event type:', req.body.type);
  }

  // Return 200 to acknowledge receipt
  res.json({ received: true });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Webhook server running on port ${PORT}`);
});