Webhooks

POST /your-webhook-endpoint HTTP/1.1
Content-Type: application/json
X-Crypax-Signature: v1=a4b3c2d1e0f9...
X-Crypax-Event: payment.confirmed
X-Crypax-Timestamp: 1704067200

{
  "id": "pay_01HZ...",
  "status": "confirmed",
  "txHash": "0xabcdef1234...",
  "blockNumber": 12345,
  "amount": "10.00",
  "currency": "native",
  "chainId": 41956
}

const crypto = require('crypto');

function verifyWebhookSignature(rawBody, signatureHeader, timestampHeader, secret) {
  // signatureHeader format: "v1=<hex>"
  const signedPayload = timestampHeader + '.' + rawBody;

  const expected = 'v1=' + crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Reject stale requests (older than 5 minutes)
  const age = Math.floor(Date.now() / 1000) - Number(timestampHeader);
  if (age > 300) {
    throw new Error('Webhook timestamp too old');
  }

  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expected)
  );
}

const express = require('express');
const crypto = require('crypto');

const app = express();

app.post('/webhooks/crypax', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-crypax-signature'];
  const timestamp = req.headers['x-crypax-timestamp'];
  const eventType = req.headers['x-crypax-event'];
  const secret = process.env.CRYPAX_WEBHOOK_SECRET;

  // Build signed payload: timestamp.rawBody
  const signedPayload = timestamp + '.' + req.body.toString();
  const expected = 'v1=' + crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(400).json({ error: 'Invalid signature' });
  }

  const payload = JSON.parse(req.body.toString());

  switch (eventType) {
    case 'payment.confirmed':
      console.log('Payment confirmed:', payload.id, payload.txHash);
      break;
    case 'payment.failed':
      console.log('Payment failed:', payload.id);
      break;
    case 'payment.expired':
      console.log('Payment expired:', payload.id);
      break;
    case 'refund.completed':
      console.log('Refund completed:', payload.id);
      break;
  }

  res.json({ received: true });
});

import { Crypax } from '@crypax/node';
import express from 'express';

const app = express();
const crypax = new Crypax('sk_live_...');

app.post('/webhooks/crypax', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-crypax-signature'] as string;

  try {
    const event = crypax.webhooks.constructEvent(
      req.body,           // raw body string
      signature,
      process.env.CRYPAX_WEBHOOK_SECRET!,
    );

    switch (event.type) {
      case 'payment.confirmed':
        console.log('Confirmed:', event.data.id, event.data.txHash);
        break;
      case 'payment.expired':
        console.log('Expired:', event.data.id);
        break;
      case 'refund.completed':
        console.log('Refund completed:', event.data.id);
        break;
      case 'customer.created':
        console.log('New customer:', event.data.id);
        break;
    }

    res.json({ received: true });
  } catch (err) {
    res.status(400).json({ error: 'Invalid signature' });
  }
});