Webhooks

{
  "eventType": "deposit.finalized",
  "eventId": "3f1b2c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
  "deposit": {
    "uuid": "8f3a1c2e-5b6d-4e7f-9a0b-1c2d3e4f5a6b",
    "orderId": "order-2026-000042",
    "status": "paid",
    "assetCode": "USDT_TRC20",
    "expectedAmount": "100.50",
    "receivedAmount": "100.50",
    "address": "TKh9wq8c4dZsL1mP2nQ3rS4tU5vW6xY7zA",
    "memo": null,
    "txHash": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
    "confirmations": 19,
    "requiredConfirmations": 19,
    "finalizedAt": "2026-06-02T20:41:05.000Z"
  }
}

{
  "eventType": "payout.confirmed",
  "eventId": "9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d",
  "payout": {
    "uuid": "c1d2e3f4-a5b6-4c7d-8e9f-0a1b2c3d4e5f",
    "orderId": "payout-2026-000077",
    "status": "confirmed",
    "assetCode": "USDT_TRC20",
    "amount": "50.000000",
    "destinationAddress": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t",
    "destinationMemo": null,
    "txHash": "f0e9d8c7b6a5948372615f4e3d2c1b0a9f8e7d6c5b4a39281706f5e4d3c2b1a0",
    "explorerTxUrl": "https://tronscan.org/#/transaction/f0e9d8c7b6a5...",
    "confirmations": 19,
    "requiredConfirmations": 19,
    "failReason": null,
    "updatedAt": "2026-06-02T20:56:30.000Z"
  }
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const CALLBACK_SECRET = process.env.CALLBACK_SECRET;

// ВАЖНО: express.raw — получаем сырой Buffer, а не распарсенный объект.
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body;                       // Buffer — сырые байты тела
  const sig = req.header('X-Signature') ?? '';

  const expected = crypto
    .createHmac('sha256', CALLBACK_SECRET)
    .update(raw)
    .digest('hex');

  // constant-time сравнение; длины должны совпадать
  const a = Buffer.from(expected);
  const b = Buffer.from(sig);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).end();             // подпись не совпала — отклоняем
  }

  const event = JSON.parse(raw.toString('utf8'));

  // Идемпотентность: если event.eventId уже обработан — выходим без побочных эффектов.
  if (alreadyProcessed(event.eventId)) {
    return res.status(200).end();
  }

  // ... ваша бизнес-логика по event.eventType / event.deposit / event.payout ...
  markProcessed(event.eventId);

  res.status(200).end();                       // 2xx в течение 10с = доставлено
});

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)
CALLBACK_SECRET = os.environ["CALLBACK_SECRET"].encode()

@app.post("/webhook")
def webhook():
    raw = request.get_data()                   # сырые байты тела (не json!)
    sig = request.headers.get("X-Signature", "")

    expected = hmac.new(CALLBACK_SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig): # constant-time
        abort(401)

    event = request.get_json()

    # Идемпотентность по event["eventId"]
    if already_processed(event["eventId"]):
        return "", 200

    # ... ваша бизнес-логика ...
    mark_processed(event["eventId"])
    return "", 200

curl -X POST https://wallet.your-exchange.com/v1/public/webhooks/test \
  -H "X-Api-Id: pk_live_a1b2c3d4" \
  -H "X-Timestamp: 1780000000" \
  -H "X-Signature: 9f1c0b8a7d6e5f4c3b2a1908f7e6d5c4b3a2918f0e7d6c5b4a392817f6e5d4c3"

import crypto from 'node:crypto';

const BASE = 'https://wallet.your-exchange.com';
const API_ID = 'pk_live_a1b2c3d4';
const API_SECRET = process.env.API_SECRET; // не уходит по сети

const ts = Math.floor(Date.now() / 1000).toString();
const body = '';                              // POST без тела => пустая строка
const message = `${ts}.${body}`;              // "<timestamp>."
const sig = crypto.createHmac('sha256', API_SECRET).update(message).digest('hex');

const res = await fetch(`${BASE}/v1/public/webhooks/test`, {
  method: 'POST',
  headers: {
    'X-Api-Id': API_ID,
    'X-Timestamp': ts,
    'X-Signature': sig,
  },
});
console.log(await res.json());

curl -X POST \
  https://wallet.your-exchange.com/v1/public/webhooks/resend/3f1b2c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d \
  -H "X-Api-Id: pk_live_a1b2c3d4" \
  -H "X-Timestamp: 1780000000" \
  -H "X-Signature: 7d6c5b4a392817f6e5d4c3b2a1908f7e6d5c4b3a2918f0e7d6c5b4a392817f6e5"

import crypto from 'node:crypto';

const BASE = 'https://wallet.your-exchange.com';
const API_ID = 'pk_live_a1b2c3d4';
const API_SECRET = process.env.API_SECRET;
const eventId = '3f1b2c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d';

const ts = Math.floor(Date.now() / 1000).toString();
const message = `${ts}.`;                      // POST без тела => "<timestamp>."
const sig = crypto.createHmac('sha256', API_SECRET).update(message).digest('hex');

const res = await fetch(`${BASE}/v1/public/webhooks/resend/${eventId}`, {
  method: 'POST',
  headers: {
    'X-Api-Id': API_ID,
    'X-Timestamp': ts,
    'X-Signature': sig,
  },
});
console.log(await res.json());