Webhooks

POST https://votre-site.com/webhooks/gateway
Content-Type: application/json
X-Gateway-Event: payment.succeeded
X-Gateway-Delivery: a0912fcc-07bc-48c8-8d70-0ef54dcbfe2f
X-Gateway-Timestamp: 1791213506
X-Gateway-Signature: sha256=5f1c0e…
X-Gateway-Environment: LIVE

{
  "id": "a0912fcc-07bc-48c8-8d70-0ef54dcbfe2f",
  "event": "payment.succeeded",
  "sequence": 1,
  "livemode": true,
  "createdAt": "2026-10-05T15:24:27.740809",
  "data": {
    "reference": "PAY261005DE7PIJWDCW",
    "externalReference": "CMD-1042",
    "type": "PAYMENT",
    "status": "SUCCESS",
    "amount": 5000.00,
    "fee": 75.00,
    "currency": "XOF",
    "network": "ORANGE_MONEY",
    "phoneNumber": "+22676112233",
    "operatorReference": "CI241005.1234.A12345",
    "completedAt": "2026-10-05T15:24:27.73765"
  }
}

signature = HMAC-SHA256(secret, timestamp + "." + corps)

X-Gateway-Timestamp: 1791213506
X-Gateway-Signature: sha256=<signature en hexadécimal>

const crypto = require("crypto");
const express = require("express");
const app = express();

app.post("/webhooks/gateway", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-Gateway-Timestamp");
  const received = (req.get("X-Gateway-Signature") || "").replace(/^sha256=/, "");
  const expected = crypto
    .createHmac("sha256", process.env.GATEWAY_WEBHOOK_SECRET)
    .update(`${timestamp}.${req.body}`) // req.body : Buffer brut
    .digest("hex");

  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
  const valid = received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!fresh || !valid) return res.sendStatus(401);

  const notification = JSON.parse(req.body);
  res.sendStatus(200);              // répondre vite…
  handleNotification(notification); // …puis traiter (idempotent)
});

$body = file_get_contents('php://input'); // corps brut
$timestamp = $_SERVER['HTTP_X_GATEWAY_TIMESTAMP'] ?? '';
$received = preg_replace('/^sha256=/', '', $_SERVER['HTTP_X_GATEWAY_SIGNATURE'] ?? '');
$expected = hash_hmac('sha256', $timestamp . '.' . $body, getenv('GATEWAY_WEBHOOK_SECRET'));

if (abs(time() - (int) $timestamp) > 300 || !hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}

$notification = json_decode($body, true);
http_response_code(200);
// traiter $notification (idempotent)

import hashlib, hmac, os, time
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/gateway")
def gateway_webhook():
    body = request.get_data()  # corps brut (bytes)
    timestamp = request.headers.get("X-Gateway-Timestamp", "")
    received = request.headers.get("X-Gateway-Signature", "").removeprefix("sha256=")
    expected = hmac.new(os.environ["GATEWAY_WEBHOOK_SECRET"].encode(),
                        f"{timestamp}.".encode() + body, hashlib.sha256).hexdigest()
    if abs(time.time() - int(timestamp or 0)) > 300 or not hmac.compare_digest(expected, received):
        abort(401)
    notification = request.get_json()
    # traiter notification (idempotent)
    return "", 200