Webhooks

{
  "event": "PAYMENT_SUCCESS",
  "timestamp": "2026-03-13T10:30:00Z",
  "environment": "sandbox",
  "data": {
    "order_number": "DP-20260313-A7X9K2",
    "merchant_order_id": "SHOP-456",
    "amount": 2500.00,
    "currency": "INR",
    "status": "PAID",
    "dispute_count": 0,
    "buyer": {
      "email": "rahul@example.com",
      "name": "Rahul Sharma"
    }
  }
}

const crypto = require("crypto");

function verifyWebhook(rawBody, signature, timestamp, webhookSecret) {
  // Reject webhooks older than 5 minutes (replay protection)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return false;
  }

  const signedPayload = timestamp + "." + rawBody;
  const expected = crypto
    .createHmac("sha256", webhookSecret)
    .update(signedPayload, "utf8")
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected, "hex")
  );
}

// In your Express handler:
app.post("/webhooks/doorpay", (req, res) => {
  const signature = req.headers["x-doorpay-signature"];
  const timestamp = req.headers["x-doorpay-timestamp"];
  const rawBody = req.rawBody; // make sure to capture raw body

  if (!verifyWebhook(rawBody, signature, timestamp, process.env.DOORPAY_WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }

  const event = req.body;
  console.log("Received event:", event.event, event.data.order_number);

  // Handle the event based on type
  switch (event.event) {
    case "PAYMENT_SUCCESS":
      // Mark the order as paid in your system
      break;
    case "DISPUTE_RAISED":
      // Alert your support team
      break;
    case "ORDER_COMPLETED":
      // Funds released — finalize the order
      break;
  }

  res.status(200).send("OK");
});

import hmac
import hashlib
import time

def verify_webhook(raw_body: bytes, signature: str, timestamp: str, webhook_secret: str) -> bool:
    # Reject webhooks older than 5 minutes (replay protection)
    if abs(time.time() - int(timestamp)) > 300:
        return False

    signed_payload = f"{timestamp}.".encode("utf-8") + raw_body
    expected = hmac.new(
        webhook_secret.encode("utf-8"),
        signed_payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# In your Flask handler:
@app.route("/webhooks/doorpay", methods=["POST"])
def handle_webhook():
    signature = request.headers.get("X-DoorPay-Signature")
    timestamp = request.headers.get("X-DoorPay-Timestamp")
    if not verify_webhook(request.data, signature, timestamp, WEBHOOK_SECRET):
        return "Invalid signature", 401

    event = request.json
    print(f"Received: {event['event']} for {event['data']['order_number']}")

    return "OK", 200