Webhook Mutasi QRIS Realtime

<?php
// 1. Ambil Secret Key Anda dari menu /qris
$secretKey = "YOUR_WEBHOOK_SECRET_KEY";

// 2. Baca RAW payload body dan header signature
$rawBody = file_get_contents('php://input');
$receivedSignature = $_SERVER['HTTP_X_CUTIEZY_SIGNATURE'] ?? '';

// 3. Hitung HMAC SHA-256
$expectedSignature = hash_hmac('sha256', $rawBody, $secretKey);

// 4. Verifikasi keaslian request dengan hash_equals
if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

// 5. Decode JSON dan proses transaksi
$payload = json_decode($rawBody, true);
$event = $payload['event'] ?? '';
$data = $payload['data'] ?? [];

if ($event === 'qris.payment') {
    $ref = $data['reference'];
    $amount = $data['amount'];
    
    // TODO: Update status invoice order Anda di database menjadi PAID
    // Contoh: Orders::markAsPaid($ref, $amount);
}

// 6. Selalu kembalikan HTTP 200 OK
http_response_code(200);
header('Content-Type: application/json');
echo json_encode(['received' => true]);

const express = require('express');
const crypto = require('crypto');
const app = express();

const SECRET_KEY = 'YOUR_WEBHOOK_SECRET_KEY';

// Penting: Gunakan express.raw() atau tangkap rawBody untuk verifikasi signature
app.post('/api/webhook/qris', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  const signature = req.headers['x-cutiezy-signature'] || '';

  const expectedSignature = crypto
    .createHmac('sha256', SECRET_KEY)
    .update(rawBody)
    .digest('hex');

  if (signature !== expectedSignature) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const payload = JSON.parse(rawBody);
  console.log('Notifikasi Transaksi Diterima:', payload);

  if (payload.event === 'qris.payment') {
    const { reference, amount, customer } = payload.data;
    // TODO: Proses pembayaran invoice Anda
  }

  res.status(200).json({ received: true });
});

app.listen(3000, () => console.log('Webhook server running on port 3000'));

from fastapi import FastAPI, Request, HTTPException
import hmac
import hashlib
import json

app = FastAPI()
SECRET_KEY = b"YOUR_WEBHOOK_SECRET_KEY"

@app.post("/api/webhook/qris")
async def handle_qris_webhook(request: Request):
    raw_body = await request.body()
    signature = request.headers.get("x-cutiezy-signature", "")

    expected_signature = hmac.new(SECRET_KEY, raw_body, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected_signature, signature):
        raise HTTPException(status_code=401, detail="Invalid signature")

    payload = json.loads(raw_body.decode("utf-8"))
    
    if payload.get("event") == "qris.payment":
        data = payload.get("data", {})
        print(f"Pembayaran Masuk: Rp {data.get('amount')} (Ref: {data.get('reference')})")
        # TODO: Jalankan proses fulfillment order

    return {"received": True}