Webhooks

import crypto from "crypto";

function verifyWebhook(req, secretKey, businessCode) {
  const signature = req.headers["x-credo-signature"];
  const expected = crypto
    .createHash("sha512")
    .update(secretKey + businessCode)
    .digest("hex");

  return signature === expected;
}

// Express.js example
app.post("/webhooks/credo", express.json(), (req, res) => {
  const secretKey = process.env.CREDO_SECRET_KEY;
  const businessCode = req.body.data.businessCode;
  
  if (!verifyWebhook(req, secretKey, businessCode)) {
    return res.status(401).send("Invalid signature");
  }

  const { event, data } = req.body;

  switch (event) {
    case "transaction.successful":
      fulfillOrder(data);
      break;
    case "transaction.failed":
      markOrderFailed(data);
      break;
    case "transaction.transaction.transfer.reverse":
      handleTransferReversal(data);
      break;
    case "transaction.settlement.success":
      recordSettlement(data);
      break;
  }

  res.status(200).send("OK");
});

import hashlib
from flask import Flask, request

app = Flask(__name__)

def verify_webhook(request, secret_key, business_code):
    signature = request.headers.get("X-Credo-Signature", "")
    expected = hashlib.sha512((secret_key + business_code).encode()).hexdigest()
    return signature == expected

@app.route("/webhooks/credo", methods=["POST"])
def handle_webhook():
    secret_key = os.environ["CREDO_SECRET_KEY"]
    business_code = request.json["data"]["businessCode"]
    
    if not verify_webhook(request, secret_key, business_code):
        return "Invalid signature", 401

    event = request.json["event"]
    data = request.json["data"]

    match event:
        case "transaction.successful":
            fulfill_order(data)
        case "transaction.failed":
            mark_order_failed(data)
        case "transaction.transaction.transfer.reverse":
            handle_transfer_reversal(data)
        case "transaction.settlement.success":
            record_settlement(data)

    return "OK", 200

<?php
function verifyWebhook($signature, $secretKey, $businessCode) {
    $expected = hash("sha512", $secretKey . $businessCode);
    return $signature === $expected;
}

$signature = $_SERVER["HTTP_X_CREDO_SIGNATURE"] ?? "";
$secretKey = getenv("CREDO_SECRET_KEY");

$body = file_get_contents("php://input");
$payload = json_decode($body, true);
$businessCode = $payload["data"]["businessCode"];

if (!verifyWebhook($signature, $secretKey, $businessCode)) {
    http_response_code(401);
    exit("Invalid signature");
}

$event = $payload["event"];
$data = $payload["data"];

switch ($event) {
    case "transaction.successful":
        fulfillOrder($data);
        break;
    case "transaction.failed":
        markOrderFailed($data);
        break;
    case "transaction.transaction.transfer.reverse":
        handleTransferReversal($data);
        break;
    case "transaction.settlement.success":
        recordSettlement($data);
        break;
}

http_response_code(200);
echo "OK";

import java.security.MessageDigest;
import java.nio.charset.StandardCharsets;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import spark.Request;
import spark.Response;
import static spark.Spark.*;

public class WebhookHandler {
    private static final String SECRET_KEY = System.getenv("CREDO_SECRET_KEY");
    private static final ObjectMapper mapper = new ObjectMapper();

    public static void main(String[] args) {
        post("/webhooks/credo", (req, res) -> handleWebhook(req, res));
    }

    private static String handleWebhook(Request req, Response res) {
        try {
            String signature = req.headers("X-Credo-Signature");
            String body = req.body();
            
            JsonNode payload = mapper.readTree(body);
            String businessCode = payload.get("data").get("businessCode").asText();

            if (!verifyWebhook(signature, businessCode)) {
                res.status(401);
                return "Invalid signature";
            }

            String event = payload.get("event").asText();
            JsonNode data = payload.get("data");

            switch (event) {
                case "transaction.successful":
                    fulfillOrder(data);
                    break;
                case "transaction.failed":
                    markOrderFailed(data);
                    break;
                case "transaction.transaction.transfer.reverse":
                    handleTransferReversal(data);
                    break;
                case "transaction.settlement.success":
                    recordSettlement(data);
                    break;
            }

            res.status(200);
            return "OK";
        } catch (Exception e) {
            res.status(500);
            return "Error processing webhook";
        }
    }

    private static boolean verifyWebhook(String signature, String businessCode) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-512");
        byte[] hash = digest.digest((SECRET_KEY + businessCode).getBytes(StandardCharsets.UTF_8));
        
        StringBuilder hexString = new StringBuilder();
        for (byte b : hash) {
            String hex = Integer.toHexString(0xff & b);
            if (hex.length() == 1) hexString.append('0');
            hexString.append(hex);
        }
        
        return hexString.toString().equals(signature);
    }

    private static void fulfillOrder(JsonNode data) { /* Implementation */ }
    private static void markOrderFailed(JsonNode data) { /* Implementation */ }
    private static void handleTransferReversal(JsonNode data) { /* Implementation */ }
    private static void recordSettlement(JsonNode data) { /* Implementation */ }
}

using Microsoft.AspNetCore.Mvc;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

[ApiController]
[Route("webhooks/credo")]
public class WebhookController : ControllerBase
{
    private readonly string _secretKey;

    public WebhookController(IConfiguration config)
    {
        _secretKey = config["CREDO_SECRET_KEY"];
    }

    [HttpPost]
    public IActionResult HandleWebhook([FromBody] JsonElement payload)
    {
        string signature = Request.Headers["X-Credo-Signature"];
        string businessCode = payload.GetProperty("data").GetProperty("businessCode").GetString();

        if (!VerifyWebhook(signature, businessCode))
        {
            return Unauthorized("Invalid signature");
        }

        string eventType = payload.GetProperty("event").GetString();
        JsonElement data = payload.GetProperty("data");

        switch (eventType)
        {
            case "transaction.successful":
                FulfillOrder(data);
                break;
            case "transaction.failed":
                MarkOrderFailed(data);
                break;
            case "transaction.transaction.transfer.reverse":
                HandleTransferReversal(data);
                break;
            case "transaction.settlement.success":
                RecordSettlement(data);
                break;
        }

        return Ok("OK");
    }

    private bool VerifyWebhook(string signature, string businessCode)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] inputBytes = Encoding.UTF8.GetBytes(_secretKey + businessCode);
            byte[] hashBytes = sha512.ComputeHash(inputBytes);
            string expected = BitConverter.ToString(hashBytes).Replace("-", "").ToLower();
            return expected.Equals(signature, StringComparison.OrdinalIgnoreCase);
        }
    }

    private void FulfillOrder(JsonElement data) { /* Implementation */ }
    private void MarkOrderFailed(JsonElement data) { /* Implementation */ }
    private void HandleTransferReversal(JsonElement data) { /* Implementation */ }
    private void RecordSettlement(JsonElement data) { /* Implementation */ }
}