Webhooks

import express from 'express'
import { DottsPay } from '@dottspay/node'

const app = express()

// Register this route before app.use(express.json()), so the body stays raw.
app.post('/webhooks/dottspay', express.raw({ type: 'application/json' }), async (req, res) => {
  let event
  try {
    event = DottsPay.webhooks.constructEvent(
      req.body, // a Buffer
      req.get('X-DottsPay-Signature'),
      process.env.DOTTSPAY_WEBHOOK_SECRET,
    )
  } catch {
    return res.sendStatus(400)
  }

  // Acknowledge first. Do slow work after replying, or on a queue.
  res.sendStatus(200)

  if (await seenEvents.has(event.id)) return // duplicate delivery
  await seenEvents.add(event.id)

  switch (event.event) {
    case 'charge.success':
      await orders.markPaid(event.data.metadata?.order_id, event.data.reference)
      break
    case 'charge.failed':
      await orders.noteFailure(event.data.reference, event.data.failure_reason)
      break
    case 'refund.created':
      await orders.noteRefund(event.data.transaction_reference, event.data.amount)
      break
  }
})

app.use(express.json()) // the rest of your app

import crypto from 'node:crypto'
import express from 'express'

const app = express()

app.post('/webhooks/dottspay', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.get('X-DottsPay-Signature') ?? ''
  const expected = crypto
    .createHmac('sha512', process.env.DOTTSPAY_WEBHOOK_SECRET)
    .update(req.body) // the raw Buffer, not a parsed object
    .digest()

  const given = Buffer.from(signature, 'hex')
  if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected)) {
    return res.sendStatus(400)
  }

  // Only now is it safe to parse.
  const event = JSON.parse(req.body.toString('utf8'))
  res.sendStatus(200)

  handleEvent(event).catch(console.error)
})

<?php
// webhook.php
$payload   = file_get_contents('php://input'); // raw body
$signature = strtolower($_SERVER['HTTP_X_DOTTSPAY_SIGNATURE'] ?? '');
$secret    = getenv('DOTTSPAY_WEBHOOK_SECRET');

$expected = hash_hmac('sha512', $payload, $secret);

// hash_equals is a constant-time comparison.
if (!hash_equals($expected, $signature)) {
    http_response_code(400);
    exit;
}

http_response_code(200);
$event = json_decode($payload, true);

if ($event['event'] === 'charge.success') {
    $tx = $event['data'];
    // Dedupe on $event['id'], then fulfil the order for $tx['reference'].
}