partnerId|transactionHash|amount|timestamp

signature = Hex(HMAC-SHA256(api_secret, "partnerId|txHash|amount|timestamp"))

const crypto = require('crypto');

function verifySignature(body, apiSecret) {
  const { partnerId, transactionHash, amount, timestamp, signature } = body;

  // Build signature data (delimiter |)
  const signatureData = `${partnerId}|${transactionHash}|${amount}|${timestamp}`;

  const computed = crypto
    .createHmac('sha256', apiSecret)
    .update(signatureData)
    .digest('hex');

  return computed === signature;
}

app.post('/webhook', (req, res) => {
  const apiSecret = process.env.API_SECRET;

  if (!verifySignature(req.body, apiSecret)) {
    return res.status(401).json({ error: 'Signature mismatch' });
  }

  res.status(200).json({ success: true });
});

import hmac
import hashlib
from flask import Flask, request

app = Flask(__name__)
API_SECRET = 'your_api_secret'

@app.route('/webhook', methods=['POST'])
def webhook():
    body = request.get_json()

    # Build signature data (delimiter |)
    signature_data = f"{body['partnerId']}|{body['transactionHash']}|{body['amount']}|{body['timestamp']}"

    computed = hmac.new(
        API_SECRET.encode(),
        signature_data.encode(),
        hashlib.sha256
    ).hexdigest()

    # Verify signature
    if computed != body.get('signature'):
        return {'error': 'Signature mismatch'}, 401

    return {'success': True}, 200

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Map;

@PostMapping("/webhook")
public ResponseEntity<?> receiveWebhook(@RequestBody Map<String, Object> body) {
  try {
    String apiSecret = System.getenv("API_SECRET");

    // Build signature data (delimiter |)
    String signatureData = body.get("partnerId") + "|"
      + body.get("transactionHash") + "|"
      + body.get("amount") + "|"
      + body.get("timestamp");

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(
      apiSecret.getBytes(StandardCharsets.UTF_8),
      "HmacSHA256"
    ));
    byte[] hash = mac.doFinal(signatureData.getBytes(StandardCharsets.UTF_8));

    // hex encode
    StringBuilder hex = new StringBuilder();
    for (byte b : hash) {
      hex.append(String.format("%02x", b));
    }

    if (!hex.toString().equals(body.get("signature"))) {
      return ResponseEntity.status(401).build();
    }

    return ResponseEntity.ok().build();
  } catch (Exception e) {
    return ResponseEntity.status(500).build();
  }
}

app.post('/webhook', async (req, res) => {
  // Idempotency key = eventType + transactionId (transactionHash is "" before broadcast)
  const { eventType, transactionId } = req.body;

  try {
    // 1. Check for a duplicate event key
    const existing = await db.webhookEvents.findOne({
      event_type: eventType,
      transaction_id: transactionId
    });
    if (existing) {
      return res.status(200).json({
        success: true,
        message: 'Event already processed'
      });
    }

    // 2. Verify signature (omitted)

    // 3. Handle event
    await processEvent(req.body);

    // 4. Store the event key
    await db.webhookEvents.insertOne({
      event_type: eventType,
      transaction_id: transactionId,
      tx_hash: req.body.transactionHash,  // reference only — may be ""
      processed_at: new Date()
    });

    res.status(200).json({ success: true });
  } catch (error) {
    console.error(error);
    res.status(500).json({ error: 'Internal error' });
  }
});

const express = require('express');
const crypto = require('crypto');
const Bull = require('bull');

const app = express();
const webhookQueue = new Bull('webhooks');
const API_SECRET = process.env.API_SECRET;

app.use(express.json());

// Signature verification helper
function verifySignature(body) {
  const { partnerId, transactionHash, amount, timestamp, signature } = body;
  const signatureData = `${partnerId}|${transactionHash}|${amount}|${timestamp}`;
  const computed = crypto
    .createHmac('sha256', API_SECRET)
    .update(signatureData)
    .digest('hex');
  return computed === signature;
}

// Webhook handler
app.post('/webhook', async (req, res) => {
  // 1. Verify signature
  if (!verifySignature(req.body)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  // 2. Check for duplicates (eventType + transactionId)
  const exists = await db.webhookEvents.findOne({
    event_type: req.body.eventType,
    transaction_id: req.body.transactionId
  });
  if (exists) {
    return res.status(200).json({ success: true });
  }

  // 3. Enqueue and respond immediately
  await webhookQueue.add(req.body);
  res.status(200).json({ success: true });
});

// Background job
webhookQueue.process(async (job) => {
  const data = job.data;
  try {
    switch (data.eventType) {
      case 'DEPOSIT_CONFIRMED':
        // data.amount is net (grossAmount - feeAmount) — credit this value
        await handleDepositConfirmed(data);
        break;
      case 'P2P_ORDER_COMPLETE':
        // P2P deposit order closed. Credit data.settledAmount.
        // data.transactionId is an ORDER id — a different id space from deposits
        await handleP2pOrderComplete(data);
        break;
      case 'WITHDRAWAL_REQUESTED':
        // Accepted. Approval is not notified — the next event closes the withdrawal
        await handleWithdrawalRequested(data);
        break;
      case 'WITHDRAWAL_COMPLETED':
        // Paid out. data.settlementMethod is 'ONCHAIN' or 'P2P'
        await handleWithdrawalCompleted(data);
        break;
      case 'WITHDRAWAL_FAILED':
        // Closed without paying out. data.reason: REJECTED | CANCELLED_BY_ADMIN |
        //   CANCELLED_BY_PARTNER | EXHAUSTED | FAILED
        await handleWithdrawalFailed(data);
        break;
      default:
        // unknown event type — ignore, but still acknowledge
        break;
    }
    await db.webhookEvents.insertOne({
      event_type: data.eventType,
      transaction_id: data.transactionId,
      tx_hash: data.transactionHash,
      processed_at: new Date()
    });
  } catch (error) {
    console.error('Webhook processing error:', error);
    throw error;
  }
});

app.listen(3000);

from flask import Flask, request, jsonify
from celery import Celery
import hmac
import hashlib

app = Flask(__name__)
celery = Celery(app.name, broker='redis://localhost:6379')

API_SECRET = 'your_api_secret'

def verify_signature(body):
    signature_data = f"{body['partnerId']}|{body['transactionHash']}|{body['amount']}|{body['timestamp']}"
    computed = hmac.new(
        API_SECRET.encode(),
        signature_data.encode(),
        hashlib.sha256
    ).hexdigest()
    return computed == body.get('signature')

@app.route('/webhook', methods=['POST'])
def receive_webhook():
    body = request.get_json()

    # 1. Verify signature
    if not verify_signature(body):
        return jsonify({'error': 'Unauthorized'}), 401

    # 2. Check for duplicates (eventType + transactionId)
    event_key = {'event_type': body['eventType'], 'transaction_id': body['transactionId']}
    if db.webhook_events.find_one(event_key):
        return jsonify({'success': True}), 200

    # 3. Process async and respond immediately
    process_webhook.delay(body)
    return jsonify({'success': True}), 200

@celery.task
def process_webhook(data):
    event_type = data['eventType']
    try:
        # 5 event types are sent. Anything else: ignore, but still answer 200
        if event_type == 'DEPOSIT_CONFIRMED':
            # data['amount'] is net (grossAmount - feeAmount) — credit this value
            handle_deposit_confirmed(data)
        elif event_type == 'P2P_ORDER_COMPLETE':
            # P2P deposit order closed. Credit data['settledAmount'].
            # data['transactionId'] is an ORDER id — a different id space from deposits
            handle_p2p_order_complete(data)
        elif event_type == 'WITHDRAWAL_REQUESTED':
            # Accepted. Approval is not notified — the next event closes the withdrawal
            handle_withdrawal_requested(data)
        elif event_type == 'WITHDRAWAL_COMPLETED':
            # Paid out. data['settlementMethod'] is 'ONCHAIN' or 'P2P'
            handle_withdrawal_completed(data)
        elif event_type == 'WITHDRAWAL_FAILED':
            # Closed without paying out. data['reason']: REJECTED | CANCELLED_BY_ADMIN |
            #   CANCELLED_BY_PARTNER | EXHAUSTED | FAILED
            handle_withdrawal_failed(data)

        db.webhook_events.insert_one({
            'event_type': event_type,
            'transaction_id': data['transactionId'],
            'tx_hash': data['transactionHash'],
            'processed_at': datetime.utcnow()
        })
    except Exception as e:
        print(f'Error processing webhook: {e}')
        raise

if __name__ == '__main__':
    app.run()