Webhook Integration

{
  "amount": 999,
  "currency": "USD",
  "fees": 45,
  "metadata": {
    "integration_session_id": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
    "user_id": "usr_123"
  },
  "type": "succeeded",
  "provider": "stripe",
  "order_id": "order_12345",
  "items": [
    { "name": "Pro plan", "quantity": 1, "price": 999 }
  ],
  "payment_method": "credit",
  "customer": {
    "name": "John Doe",
    "email": "john@example.com"
  },
  "subscription": {
    "id": "psub_8fKx2LmQp4ZrT7vW1nYc3aBd",
    "status": "active",
    "interval": "month",
    "interval_count": 1,
    "cycle": 1,
    "current_period_end": "2026-11-13T10:30:00+00:00",
    "cancel_at_period_end": false,
    "management_url": "https://secure.payviox.com/subscription/k3Jd9QwL2xVb7NmP4tRz8YcF1sHg6UaE5oWi0qXn3BvM7ZpD"
  }
}

{
  "amount": 999,
  "currency": "USD",
  "fees": 30,
  "metadata": {
    "integration_session_id": "Wm4kP9sT2vXc7LqA1nBz8RdY3fHj6GeU",
    "user_id": "usr_123"
  },
  "type": "succeeded",
  "provider": "stripe",
  "order_id": "order_12345-2",
  "items": [
    { "name": "Pro plan", "quantity": 1, "price": 999 }
  ],
  "payment_method": "credit",
  "customer": {
    "name": "John Doe",
    "email": "john@example.com"
  },
  "subscription": {
    "id": "psub_8fKx2LmQp4ZrT7vW1nYc3aBd",
    "status": "active",
    "interval": "month",
    "interval_count": 1,
    "cycle": 2,
    "current_period_end": "2026-12-13T10:30:00+00:00",
    "cancel_at_period_end": false,
    "management_url": "https://secure.payviox.com/subscription/k3Jd9QwL2xVb7NmP4tRz8YcF1sHg6UaE5oWi0qXn3BvM7ZpD"
  }
}

{
  "amount": 999,
  "currency": "USD",
  "fees": 30,
  "metadata": {
    "integration_session_id": "Tq8nV3bK6wYp1ZsE9mRc4LxD7hGf2JaU",
    "user_id": "usr_123"
  },
  "type": "subscription_payment_failed",
  "provider": "stripe",
  "order_id": "order_12345-3",
  "items": [
    { "name": "Pro plan", "quantity": 1, "price": 999 }
  ],
  "payment_method": "credit",
  "failure_reason": "insufficient_funds",
  "subscription": {
    "id": "psub_8fKx2LmQp4ZrT7vW1nYc3aBd",
    "status": "past_due",
    "interval": "month",
    "interval_count": 1,
    "cycle": 3,
    "current_period_end": "2027-01-13T10:30:00+00:00",
    "cancel_at_period_end": false,
    "management_url": "https://secure.payviox.com/subscription/k3Jd9QwL2xVb7NmP4tRz8YcF1sHg6UaE5oWi0qXn3BvM7ZpD"
  }
}

{
  "amount": 999,
  "currency": "USD",
  "fees": 45,
  "metadata": {
    "integration_session_id": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
    "user_id": "usr_123"
  },
  "type": "subscription_canceled",
  "provider": "stripe",
  "order_id": "order_12345",
  "items": [
    { "name": "Pro plan", "quantity": 1, "price": 999 }
  ],
  "payment_method": "credit",
  "subscription": {
    "id": "psub_8fKx2LmQp4ZrT7vW1nYc3aBd",
    "status": "canceled",
    "interval": "month",
    "interval_count": 1,
    "cycle": 1,
    "current_period_end": "2026-12-13T10:30:00+00:00",
    "cancel_at_period_end": true,
    "management_url": "https://secure.payviox.com/subscription/k3Jd9QwL2xVb7NmP4tRz8YcF1sHg6UaE5oWi0qXn3BvM7ZpD"
  }
}

<?php

function verifyWebhookSignature($payload, $receivedSignature, $webhookToken) {
    // Compute the expected signature
    $computedSignature = hash_hmac('sha256', $payload, $webhookToken);
    
    // Use hash_equals to prevent timing attacks
    return hash_equals($computedSignature, $receivedSignature);
}

// Example usage in a Laravel controller
public function handleWebhook(Request $request) {
    // Get the raw payload
    $payload = $request->getContent();
    
    // Get the signature from headers
    $receivedSignature = $request->header('Signature');
    
    // Your webhook token from the dashboard
    $webhookToken = env('PAYVIOX_WEBHOOK_TOKEN');
    
    // Verify the signature
    if (!verifyWebhookSignature($payload, $receivedSignature, $webhookToken)) {
        // Invalid signature - reject the request
        return response()->json(['error' => 'Invalid signature'], 401);
    }
    
    // Parse the verified payload
    $data = json_decode($payload, true);
    
    // Process the webhook based on type
    switch ($data['type']) {
        case 'succeeded':
            // Payment succeeded - fulfill the order
            $this->fulfillOrder($data['order_id'], $data);
            break;
            
        case 'pending_review':
            // Payment flagged for fraud review - DO NOT ship yet
            $this->updateOrderStatus($data['order_id'], 'pending_review');
            break;
            
        case 'declined':
            // Payment declined by fraud prevention - customer refunded
            $this->handleDeclinedPayment($data['order_id']);
            break;
            
        case 'refunded':
            // Payment was refunded
            $this->handleRefund($data['order_id'], $data);
            break;
    }
    
    // Return 200 OK to acknowledge receipt
    return response()->json(['status' => 'success'], 200);
}

private function fulfillOrder($orderId, $webhookData) {
    // Your order fulfillment logic
    $order = Order::where('order_id', $orderId)->first();
    
    if ($order) {
        $order->status = 'completed';
        $order->payment_provider = $webhookData['provider'];
        $order->payment_amount = $webhookData['amount'];
        $order->session_id = $webhookData['metadata']['integration_session_id'];
        $order->save();
        
        // Send confirmation email, provision services, etc.
    }
}

const crypto = require('crypto');
const express = require('express');

function verifyWebhookSignature(payload, receivedSignature, webhookToken) {
    // Compute the expected signature
    const computedSignature = crypto
        .createHmac('sha256', webhookToken)
        .update(payload)
        .digest('hex');
    
    // Use timingSafeEqual to prevent timing attacks
    return crypto.timingSafeEqual(
        Buffer.from(computedSignature),
        Buffer.from(receivedSignature)
    );
}

const app = express();

// Important: Use express.raw() to get the raw body for signature verification
app.post('/api/webhook', express.raw({ type: 'application/json' }), (req, res) => {
    // Get the raw payload as string
    const payload = req.body.toString('utf8');
    
    // Get the signature from headers
    const receivedSignature = req.headers['signature'];
    
    // Your webhook token from environment variable
    const webhookToken = process.env.PAYVIOX_WEBHOOK_TOKEN;
    
    // Verify the signature
    if (!verifyWebhookSignature(payload, receivedSignature, webhookToken)) {
        return res.status(401).json({ error: 'Invalid signature' });
    }
    
    // Parse the verified payload
    const data = JSON.parse(payload);
    
    // Process the webhook based on type
    switch (data.type) {
        case 'succeeded':
            fulfillOrder(data.order_id, data);
            break;
            
        case 'pending_review':
            // Payment flagged for fraud review - DO NOT ship yet
            updateOrderStatus(data.order_id, 'pending_review');
            break;
            
        case 'declined':
            // Payment declined by fraud prevention - customer refunded
            handleDeclinedPayment(data.order_id);
            break;
            
        case 'refunded':
            handleRefund(data.order_id, data);
            break;
    }
    
    // Return 200 OK to acknowledge receipt
    res.json({ status: 'success' });
});

async function fulfillOrder(orderId, webhookData) {
    // Your order fulfillment logic
    const order = await Order.findOne({ order_id: orderId });
    
    if (order) {
        order.status = 'completed';
        order.payment_provider = webhookData.provider;
        order.payment_amount = webhookData.amount;
        order.session_id = webhookData.metadata.integration_session_id;
        await order.save();
        
        // Send confirmation email, provision services, etc.
    }
}

app.listen(3000, () => {
    console.log('Webhook server listening on port 3000');
});

import hmac
import hashlib
import json
from flask import Flask, request, jsonify

app = Flask(__name__)

def verify_webhook_signature(payload, received_signature, webhook_token):
    """Verify the webhook signature"""
    # Compute the expected signature
    computed_signature = hmac.new(
        webhook_token.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    # Use compare_digest to prevent timing attacks
    return hmac.compare_digest(computed_signature, received_signature)

@app.route('/api/webhook', methods=['POST'])
def handle_webhook():
    # Get the raw payload
    payload = request.get_data(as_text=True)
    
    # Get the signature from headers
    received_signature = request.headers.get('Signature')
    
    # Your webhook token from environment variable
    webhook_token = os.environ.get('PAYVIOX_WEBHOOK_TOKEN')
    
    # Verify the signature
    if not verify_webhook_signature(payload, received_signature, webhook_token):
        return jsonify({'error': 'Invalid signature'}), 401
    
    # Parse the verified payload
    data = json.loads(payload)
    
    # Process the webhook based on type
    if data['type'] == 'succeeded':
        fulfill_order(data['order_id'], data)
    elif data['type'] == 'pending_review':
        # Payment flagged for fraud review - DO NOT ship yet
        update_order_status(data['order_id'], 'pending_review')
    elif data['type'] == 'declined':
        # Payment declined by fraud prevention - customer refunded
        handle_declined_payment(data['order_id'])
    elif data['type'] == 'refunded':
        handle_refund(data['order_id'], data)
    
    # Return 200 OK to acknowledge receipt
    return jsonify({'status': 'success'}), 200

def fulfill_order(order_id, webhook_data):
    """Handle successful payment"""
    # Your order fulfillment logic
    order = Order.query.filter_by(order_id=order_id).first()
    
    if order:
        order.status = 'completed'
        order.payment_provider = webhook_data['provider']
        order.payment_amount = webhook_data['amount']
        order.session_id = webhook_data['metadata']['integration_session_id']
        db.session.commit()
        
        # Send confirmation email, provision services, etc.

if __name__ == '__main__':
    app.run(port=3000)

require 'sinatra'
require 'json'
require 'openssl'

def verify_webhook_signature(payload, received_signature, webhook_token)
  # Compute the expected signature
  computed_signature = OpenSSL::HMAC.hexdigest(
    OpenSSL::Digest.new('sha256'),
    webhook_token,
    payload
  )
  
  # Use secure_compare to prevent timing attacks
  Rack::Utils.secure_compare(computed_signature, received_signature)
end

post '/api/webhook' do
  # Get the raw payload
  request.body.rewind
  payload = request.body.read
  
  # Get the signature from headers
  received_signature = request.env['HTTP_SIGNATURE']
  
  # Your webhook token from environment variable
  webhook_token = ENV['PAYVIOX_WEBHOOK_TOKEN']
  
  # Verify the signature
  unless verify_webhook_signature(payload, received_signature, webhook_token)
    halt 401, { error: 'Invalid signature' }.to_json
  end
  
  # Parse the verified payload
  data = JSON.parse(payload)
  
  # Process the webhook based on type
  case data['type']
  when 'succeeded'
    fulfill_order(data['order_id'], data)
  when 'pending_review'
    # Payment flagged for fraud review - DO NOT ship yet
    update_order_status(data['order_id'], 'pending_review')
  when 'declined'
    # Payment declined by fraud prevention - customer refunded
    handle_declined_payment(data['order_id'])
  when 'refunded'
    handle_refund(data['order_id'], data)
  end
  
  # Return 200 OK to acknowledge receipt
  content_type :json
  { status: 'success' }.to_json
end

def fulfill_order(order_id, webhook_data)
  # Your order fulfillment logic
  order = Order.find_by(order_id: order_id)
  
  if order
    order.status = 'completed'
    order.payment_provider = webhook_data['provider']
    order.payment_amount = webhook_data['amount']
    order.session_id = webhook_data['metadata']['integration_session_id']
    order.save
    
    # Send confirmation email, provision services, etc.
  end
end

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "io"
    "log"
    "net/http"
    "os"
)

type WebhookPayload struct {
    Amount        int                    `json:"amount"`
    Currency      string                 `json:"currency"`
    Metadata      map[string]interface{} `json:"metadata"`
    Type          string                 `json:"type"`
    Provider      string                 `json:"provider"`
    OrderID       string                 `json:"order_id"`
    Items         []Item                 `json:"items"`
    PaymentMethod string                 `json:"payment_method"`
}

type Item struct {
    Name     string `json:"name"`
    Quantity int    `json:"quantity"`
    Price    int    `json:"price"`
}

func verifyWebhookSignature(payload string, receivedSignature string, webhookToken string) bool {
    // Compute the expected signature
    mac := hmac.New(sha256.New, []byte(webhookToken))
    mac.Write([]byte(payload))
    computedSignature := hex.EncodeToString(mac.Sum(nil))
    
    // Use hmac.Equal to prevent timing attacks
    return hmac.Equal([]byte(computedSignature), []byte(receivedSignature))
}

func handleWebhook(w http.ResponseWriter, r *http.Request) {
    // Get the raw payload
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Error reading request body", http.StatusBadRequest)
        return
    }
    payload := string(body)
    
    // Get the signature from headers
    receivedSignature := r.Header.Get("Signature")
    
    // Your webhook token from environment variable
    webhookToken := os.Getenv("PAYVIOX_WEBHOOK_TOKEN")
    
    // Verify the signature
    if !verifyWebhookSignature(payload, receivedSignature, webhookToken) {
        http.Error(w, `{"error": "Invalid signature"}`, http.StatusUnauthorized)
        return
    }
    
    // Parse the verified payload
    var data WebhookPayload
    if err := json.Unmarshal(body, &data); err != nil {
        http.Error(w, "Error parsing JSON", http.StatusBadRequest)
        return
    }
    
    // Process the webhook based on type
    switch data.Type {
    case "succeeded":
        fulfillOrder(data.OrderID, data)
    case "pending_review":
        // Payment flagged for fraud review - DO NOT ship yet
        updateOrderStatus(data.OrderID, "pending_review")
    case "declined":
        // Payment declined by fraud prevention - customer refunded
        handleDeclinedPayment(data.OrderID)
    case "refunded":
        handleRefund(data.OrderID, data)
    }
    
    // Return 200 OK to acknowledge receipt
    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(http.StatusOK)
    json.NewEncoder(w).Encode(map[string]string{"status": "success"})
}

func fulfillOrder(orderID string, webhookData WebhookPayload) {
    // Your order fulfillment logic
    log.Printf("Fulfilling order %s", orderID)
    // Update database, send emails, provision services, etc.
}

func main() {
    http.HandleFunc("/api/webhook", handleWebhook)
    log.Println("Webhook server listening on port 3000")
    log.Fatal(http.ListenAndServe(":3000", nil))
}