Webhooks

{
  "eventType": "deposit.finalized",
  "eventId": "3f1b2c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
  "deposit": {
    "uuid": "8f3a1c2e-5b6d-4e7f-9a0b-1c2d3e4f5a6b",
    "orderId": "order-2026-000042",
    "status": "paid",
    "assetCode": "USDT_TRC20",
    "expectedAmount": "100.50",
    "receivedAmount": "100.50",
    "address": "TKh9wq8c4dZsL1mP2nQ3rS4tU5vW6xY7zA",
    "memo": null,
    "txHash": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
    "confirmations": 19,
    "requiredConfirmations": 19,
    "finalizedAt": "2026-06-02T20:41:05.000Z"
  }
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const CALLBACK_SECRET = process.env.CALLBACK_SECRET;

// ВАЖНО: express.raw — получаем сырой Buffer, а не распарсенный объект.
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body;                       // Buffer — сырые байты тела
  const sig = req.header('X-Signature') ?? '';

  const expected = crypto
    .createHmac('sha256', CALLBACK_SECRET)
    .update(raw)
    .digest('hex');

  // constant-time сравнение; длины должны совпадать
  const a = Buffer.from(expected);
  const b = Buffer.from(sig);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).end();             // подпись не совпала — отклоняем
  }

  const event = JSON.parse(raw.toString('utf8'));

  // Идемпотентность: если event.eventId уже обработан — выходим без побочных эффектов.
  if (alreadyProcessed(event.eventId)) {
    return res.status(200).end();
  }

  // ... ваша бизнес-логика по event.eventType / event.deposit / event.payout ...
  markProcessed(event.eventId);

  res.status(200).end();                       // 2xx в течение 10с = доставлено
});

curl -X POST https://wallet.your-exchange.com/v1/public/webhooks/test \
  -H "X-Api-Id: pk_live_a1b2c3d4" \
  -H "X-Timestamp: 1780000000" \
  -H "X-Signature: 9f1c0b8a7d6e5f4c3b2a1908f7e6d5c4b3a2918f0e7d6c5b4a392817f6e5d4c3"

curl -X POST \
  https://wallet.your-exchange.com/v1/public/webhooks/resend/3f1b2c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d \
  -H "X-Api-Id: pk_live_a1b2c3d4" \
  -H "X-Timestamp: 1780000000" \
  -H "X-Signature: 7d6c5b4a392817f6e5d4c3b2a1908f7e6d5c4b3a2918f0e7d6c5b4a392817f6e5"