Webhooks

<?php
$rawBody = file_get_contents('php://input');
$sig     = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$ts      = (int) ($_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? 0);

// 1) Janela ±5min anti-replay
if (abs(time() - $ts) > 300) {
    http_response_code(401);
    exit;
}

// 2) HMAC SHA256 timing-safe
$expected = hash_hmac('sha256', $rawBody, $WEBHOOK_SECRET);
if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit;
}

$payload = json_decode($rawBody, true);
// processar...
http_response_code(200);
echo json_encode(['received' => true]);

import crypto from 'node:crypto';
import express from 'express';

const app = express();

// IMPORTANTE: capturar raw body antes do parse JSON
app.post('/webhook/bspay',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const sig = req.headers['x-webhook-signature'];
    const ts  = parseInt(req.headers['x-webhook-timestamp'], 10);
    const raw = req.body; // Buffer

    // 1) anti-replay
    if (Math.abs(Date.now() / 1000 - ts) > 300) {
      return res.status(401).end();
    }

    // 2) HMAC timing-safe
    const expected = crypto
      .createHmac('sha256', process.env.WEBHOOK_SECRET)
      .update(raw)
      .digest('hex');

    if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
      return res.status(401).end();
    }

    const payload = JSON.parse(raw.toString('utf8'));
    // processar...
    res.status(200).json({ received: true });
  }
);

import hmac, hashlib, time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "..."

@app.route('/webhook/bspay', methods=['POST'])
def webhook():
    raw = request.get_data()  # bytes — antes do JSON parse
    sig = request.headers.get('X-Webhook-Signature', '')
    ts  = int(request.headers.get('X-Webhook-Timestamp', '0'))

    # 1) anti-replay
    if abs(int(time.time()) - ts) > 300:
        abort(401)

    # 2) HMAC timing-safe
    expected = hmac.new(WEBHOOK_SECRET.encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        abort(401)

    payload = request.get_json()
    # processar...
    return {'received': True}, 200

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "strconv"
    "time"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    raw, _ := io.ReadAll(r.Body)
    sig := r.Header.Get("X-Webhook-Signature")
    ts, _ := strconv.ParseInt(r.Header.Get("X-Webhook-Timestamp"), 10, 64)

    // 1) anti-replay
    if abs(time.Now().Unix()-ts) > 300 {
        w.WriteHeader(401); return
    }

    // 2) HMAC
    mac := hmac.New(sha256.New, []byte(webhookSecret))
    mac.Write(raw)
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expected), []byte(sig)) {
        w.WriteHeader(401); return
    }

    // processar...
    w.WriteHeader(200)
}

{
  "event": "cashin.confirmed",
  "timestamp": "2026-05-01T13:00:04-03:00",
  "transaction_id": "abc123",
  "data": {
    "transaction_id": "abc123",
    "external_id": "order_xyz",
    "type": "cashin",
    "currency": "BRL",
    "currency_type": "fiat",
    "amount": "100.00",
    "fee": "1.50",
    "amount_net": "98.50",
    "status": "confirmed",
    "source": "dynamic_qr",
    "network": "PIX",
    "e2e_id": "E17028875202604301400ABC123",
    "payer": { "name": "João Silva", "document": "12345678901" },
    "old_balance": "500.00",
    "new_balance": "598.50",
    "confirmed_at": "2026-05-01T13:00:04Z"
  }
}

{
  "event": "cashin.confirmed",
  "timestamp": "2026-05-01T13:00:30-03:00",
  "transaction_id": "abc123",
  "data": {
    "transaction_id": "abc123",
    "external_id": "crypto_001",
    "type": "cashin",
    "currency": "USDT",
    "currency_type": "crypto",
    "chain": "tron",
    "network": "TRC20",
    "amount": "50.00",
    "fee": "1.00",
    "amount_net": "49.00",
    "status": "confirmed",
    "source": "dynamic_qr",
    "tx_hash": "1c71b23e0fac...",
    "old_balance": "1000.00",
    "new_balance": "1049.00",
    "confirmed_at": "2026-05-01T13:00:30Z"
  }
}

{
  "event": "cashin.confirmed",
  "timestamp": "2026-05-01T13:00:00-03:00",
  "transaction_id": "wdep_abc123",
  "data": {
    "transaction_id": "wdep_abc123",
    "wallet_id": 41,
    "type": "cashin",
    "currency": "USDT",
    "currency_type": "crypto",
    "chain": "tron",
    "network": "TRC20",
    "amount": "5.403",
    "fee": "1.000",
    "amount_net": "4.403",
    "status": "confirmed",
    "source": "static",
    "address": "TWMrdKSXa...",
    "tx_hash": "24669f333...",
    "from_address": "TKxSenderAddress...",
    "old_balance": "100.00",
    "new_balance": "104.403",
    "confirmed_at": "2026-05-01T13:00:00Z"
  }
}

{
  "event": "cashin.confirmed",
  "timestamp": "2026-05-01T13:01:00-03:00",
  "transaction_id": "abc123",
  "data": {
    "transaction_id": "abc123",
    "external_id": "spei_001",
    "type": "cashin",
    "currency": "MXN",
    "currency_type": "fiat",
    "network": "SPEI",
    "amount": "200.00",
    "fee": "5.00",
    "amount_net": "195.00",
    "status": "confirmed",
    "source": "dynamic_qr",
    "clabe": "012345678901234567",
    "payer": { "name": "Maria Lopez", "bank": "BANORTE" },
    "old_balance": "100.00",
    "new_balance": "295.00",
    "confirmed_at": "2026-05-01T13:01:00Z"
  }
}

{
  "event": "cashout.confirmed",
  "timestamp": "2026-05-01T13:00:04-03:00",
  "transaction_id": "abc123",
  "data": {
    "transaction_id": "abc123",
    "external_id": "withdraw_001",
    "type": "cashout",
    "currency": "BRL",
    "currency_type": "fiat",
    "network": "PIX",
    "amount": "50.00",
    "fee": "1.00",
    "status": "confirmed",
    "wallet": "12345678901",
    "key_type": "cpf",
    "hash": "E17028875202604301400ABC123",
    "receiver": {
      "name": "João Silva",
      "document": "12345678901",
      "bank": "BCO DO BRASIL S.A."
    },
    "confirmed_at": "2026-05-01T13:00:04Z"
  }
}

{
  "event": "cashout.confirmed",
  "timestamp": "2026-05-01T13:00:30-03:00",
  "transaction_id": "abc123",
  "data": {
    "transaction_id": "abc123",
    "external_id": "withdraw_002",
    "type": "cashout",
    "currency": "USDT",
    "currency_type": "crypto",
    "chain": "tron",
    "network": "TRC20",
    "amount": "50.00",
    "fee": "1.50",
    "status": "confirmed",
    "wallet": "TRwLhXvqNqTqbGgHNPCEfLeEfDwfWTpuxi",
    "tx_hash": "1c71b23e0fac4e...",
    "confirmed_at": "2026-05-01T13:00:30Z"
  }
}

{
  "event": "cashout.confirmed",
  "timestamp": "2026-05-01T13:01:00-03:00",
  "transaction_id": "abc123",
  "data": {
    "transaction_id": "abc123",
    "external_id": "withdraw_003",
    "type": "cashout",
    "currency": "MXN",
    "currency_type": "fiat",
    "network": "SPEI",
    "amount": "200.00",
    "fee": "10.00",
    "status": "confirmed",
    "wallet": "012345678901234567",
    "bank_code": "BANORTE",
    "receiver": { "name": "Maria Lopez" },
    "confirmed_at": "2026-05-01T13:01:00Z"
  }
}

{
  "event": "transfer.confirmed",
  "timestamp": "2026-05-01T13:00:00-03:00",
  "transaction_id": "tx_abc123",
  "data": {
    "transaction_id": "tx_abc123",
    "direction": "received",
    "amount": "25.00",
    "currency": "BRL",
    "counterparty": "sender_username",
    "description": "Pagamento parceiro",
    "old_balance": "100.00",
    "new_balance": "125.00",
    "confirmed_at": "2026-05-01T13:00:00Z"
  }
}

{
  "event": "transfer.confirmed",
  "timestamp": "2026-05-01T13:00:00-03:00",
  "transaction_id": "tx_abc123",
  "data": {
    "transaction_id": "tx_abc123",
    "external_id": "transfer_001",
    "direction": "sent",
    "amount": "25.00",
    "currency": "BRL",
    "counterparty": "receiver_username",
    "description": "Pagamento parceiro",
    "old_balance": "150.00",
    "new_balance": "125.00",
    "confirmed_at": "2026-05-01T13:00:00Z"
  }
}