partnerId|transactionHash|amount|timestamp

signature = Hex(HMAC-SHA256(api_secret, "partnerId|txHash|amount|timestamp"))

const crypto = require('crypto');

function verifySignature(body, apiSecret) {
  const { partnerId, transactionHash, amount, timestamp, signature } = body;

  // Build signature data (delimiter |)
  const signatureData = `${partnerId}|${transactionHash}|${amount}|${timestamp}`;

  const computed = crypto
    .createHmac('sha256', apiSecret)
    .update(signatureData)
    .digest('hex');

  return computed === signature;
}

app.post('/webhook', (req, res) => {
  const apiSecret = process.env.API_SECRET;

  if (!verifySignature(req.body, apiSecret)) {
    return res.status(401).json({ error: 'Signature mismatch' });
  }

  res.status(200).json({ success: true });
});

import hmac
import hashlib
from flask import Flask, request

app = Flask(__name__)
API_SECRET = 'your_api_secret'

@app.route('/webhook', methods=['POST'])
def webhook():
    body = request.get_json()

    # Build signature data (delimiter |)
    signature_data = f"{body['partnerId']}|{body['transactionHash']}|{body['amount']}|{body['timestamp']}"

    computed = hmac.new(
        API_SECRET.encode(),
        signature_data.encode(),
        hashlib.sha256
    ).hexdigest()

    # Verify signature
    if computed != body.get('signature'):
        return {'error': 'Signature mismatch'}, 401

    return {'success': True}, 200

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Map;

@PostMapping("/webhook")
public ResponseEntity<?> receiveWebhook(@RequestBody Map<String, Object> body) {
  try {
    String apiSecret = System.getenv("API_SECRET");

    // Build signature data (delimiter |)
    String signatureData = body.get("partnerId") + "|"
      + body.get("transactionHash") + "|"
      + body.get("amount") + "|"
      + body.get("timestamp");

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(
      apiSecret.getBytes(StandardCharsets.UTF_8),
      "HmacSHA256"
    ));
    byte[] hash = mac.doFinal(signatureData.getBytes(StandardCharsets.UTF_8));

    // hex encode
    StringBuilder hex = new StringBuilder();
    for (byte b : hash) {
      hex.append(String.format("%02x", b));
    }

    if (!hex.toString().equals(body.get("signature"))) {
      return ResponseEntity.status(401).build();
    }

    return ResponseEntity.ok().build();
  } catch (Exception e) {
    return ResponseEntity.status(500).build();
  }
}

app.post('/webhook', async (req, res) => {
  const txHash = req.body.transactionHash;

  try {
    // 1. Check for duplicate transaction hash
    const existing = await db.webhookEvents.findOne({ tx_hash: txHash });
    if (existing) {
      return res.status(200).json({
        success: true,
        message: 'Event already processed'
      });
    }

    // 2. Verify signature (omitted)

    // 3. Handle event
    await processEvent(req.body);

    // 4. Store transaction hash
    await db.webhookEvents.insertOne({
      tx_hash: txHash,
      event_type: req.body.eventType,
      processed_at: new Date()
    });

    res.status(200).json({ success: true });
  } catch (error) {
    console.error(error);
    res.status(500).json({ error: 'Internal error' });
  }
});

const express = require('express');
const crypto = require('crypto');
const Bull = require('bull');

const app = express();
const webhookQueue = new Bull('webhooks');
const API_SECRET = process.env.API_SECRET;

app.use(express.json());

// Signature verification helper
function verifySignature(body) {
  const { partnerId, transactionHash, amount, timestamp, signature } = body;
  const signatureData = `${partnerId}|${transactionHash}|${amount}|${timestamp}`;
  const computed = crypto
    .createHmac('sha256', API_SECRET)
    .update(signatureData)
    .digest('hex');
  return computed === signature;
}

// Webhook handler
app.post('/webhook', async (req, res) => {
  // 1. Verify signature
  if (!verifySignature(req.body)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  // 2. Check for duplicates (by transactionHash)
  const txHash = req.body.transactionHash;
  const exists = await db.webhookEvents.findOne({ tx_hash: txHash });
  if (exists) {
    return res.status(200).json({ success: true });
  }

  // 3. Enqueue and respond immediately
  await webhookQueue.add(req.body);
  res.status(200).json({ success: true });
});

// Background job
webhookQueue.process(async (job) => {
  const data = job.data;
  try {
    switch (data.eventType) {
      case 'DEPOSIT_CONFIRMED':
        await handleDepositConfirmed(data);
        break;
      case 'WITHDRAWAL_CONFIRMED':
        await handleWithdrawalConfirmed(data);
        break;
      case 'WITHDRAWAL_FAILED':
        await handleWithdrawalFailed(data);
        break;
    }
    await db.webhookEvents.insertOne({
      tx_hash: data.transactionHash,
      event_type: data.eventType,
      processed_at: new Date()
    });
  } catch (error) {
    console.error('Webhook processing error:', error);
    throw error;
  }
});

app.listen(3000);

from flask import Flask, request, jsonify
from celery import Celery
import hmac
import hashlib

app = Flask(__name__)
celery = Celery(app.name, broker='redis://localhost:6379')

API_SECRET = 'your_api_secret'

def verify_signature(body):
    signature_data = f"{body['partnerId']}|{body['transactionHash']}|{body['amount']}|{body['timestamp']}"
    computed = hmac.new(
        API_SECRET.encode(),
        signature_data.encode(),
        hashlib.sha256
    ).hexdigest()
    return computed == body.get('signature')

@app.route('/webhook', methods=['POST'])
def receive_webhook():
    body = request.get_json()

    # 1. Verify signature
    if not verify_signature(body):
        return jsonify({'error': 'Unauthorized'}), 401

    # 2. Check for duplicates
    tx_hash = body.get('transactionHash')
    if db.webhook_events.find_one({'tx_hash': tx_hash}):
        return jsonify({'success': True}), 200

    # 3. Process async and respond immediately
    process_webhook.delay(body)
    return jsonify({'success': True}), 200

@celery.task
def process_webhook(data):
    event_type = data['eventType']
    try:
        if event_type == 'DEPOSIT_CONFIRMED':
            handle_deposit_confirmed(data)
        elif event_type == 'WITHDRAWAL_CONFIRMED':
            handle_withdrawal_confirmed(data)
        elif event_type == 'WITHDRAWAL_FAILED':
            handle_withdrawal_failed(data)

        db.webhook_events.insert_one({
            'tx_hash': data['transactionHash'],
            'event_type': event_type,
            'processed_at': datetime.utcnow()
        })
    except Exception as e:
        print(f'Error processing webhook: {e}')
        raise

if __name__ == '__main__':
    app.run()