Webhooks

import { constructEvent } from "absolutepay";

// Verifies the signature AND enforces a freshness window (default 5 min); throws on failure.
const event = constructEvent(rawBody, req.headers, process.env.ABSOLUTEPAY_WEBHOOK_SECRET!);
if (event.type === "payment.succeeded") {
  // fulfill — event.data.orderRef, event.data.amount, …
}

from absolutepay import construct_event

# Verifies the signature AND enforces a freshness window (default 5 min); raises on failure.
event = construct_event(raw_body, request.headers, os.environ["ABSOLUTEPAY_WEBHOOK_SECRET"])
if event["type"] == "payment.succeeded":
    ...  # fulfill — event["data"]["orderRef"], event["data"]["amount"], …

// Verifies the signature AND enforces a freshness window (default 5 min); errors on failure.
event, err := absolutepay.ConstructEvent(rawBody, r.Header, os.Getenv("ABSOLUTEPAY_WEBHOOK_SECRET"))
if err != nil {
	// reject with 400
}
if event.Type == "payment.succeeded" {
	// fulfill — json.Unmarshal(event.Data, &yourType)
}

import crypto from "node:crypto";

function verify(rawBody: string, timestamp: string, signature: string, secret: string): boolean {
  const expected = crypto.createHmac("sha512", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  return expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}
// verify(rawBody, headers["x-absolutepay-timestamp"], headers["x-absolutepay-signature"], secret)

import express from "express";
import { constructEvent } from "absolutepay";

const app = express();

// Use the RAW body — not express.json() — so the bytes match the signature.
app.post("/webhooks/absolutepay", express.raw({ type: "application/json" }), async (req, res) => {
  // 1. Verify (signature + freshness) on the raw bytes.
  let event;
  try {
    event = constructEvent(req.body.toString("utf8"), req.headers, process.env.ABSOLUTEPAY_WEBHOOK_SECRET!);
  } catch {
    return res.status(400).send("bad signature");
  }

  // 2. De-dupe on event.id — deliveries are at-least-once. In production, back this
  //    with a unique index (INSERT … ON CONFLICT DO NOTHING) instead of memory.
  if (!(await markProcessedOnce(event.id))) {
    return res.status(200).json({ ok: true, duplicate: true });
  }

  // 3. Ack fast, then do heavy work async (a job queue beats inline work here).
  res.status(200).json({ ok: true });

  switch (event.type) {
    case "payment.succeeded": /* fulfill order event.data.orderRef */ break;
    case "payment.failed":    /* release cart / notify customer */ break;
    case "charge.refunded":   /* mark refunded */ break;
    case "payout.settled":    /* mark batch paid */ break;
    case "payout.partial":    /* reconcile per-item results */ break;
    case "payout.failed":     /* alert + retry payout flow */ break;
  }
});

import os
from flask import Flask, request
from absolutepay import construct_event, WebhookSignatureError

app = Flask(__name__)

@app.post("/webhooks/absolutepay")
def absolutepay_webhook():
    # 1. Verify (signature + freshness) on the RAW body (request.get_data()).
    try:
        event = construct_event(request.get_data(), dict(request.headers), os.environ["ABSOLUTEPAY_WEBHOOK_SECRET"])
    except WebhookSignatureError:
        return "bad signature", 400

    # 2. De-dupe on event["id"] — deliveries are at-least-once. In production, back
    #    this with a unique index (INSERT … ON CONFLICT DO NOTHING) instead of memory.
    if not mark_processed_once(event["id"]):
        return {"ok": True, "duplicate": True}, 200

    # 3. Handle. Return 200 fast — push heavy work to a job queue.
    kind = event["type"]
    if kind == "payment.succeeded":
        ...  # fulfill order event["data"]["orderRef"]
    elif kind == "payment.failed":
        ...  # release cart / notify customer
    elif kind == "charge.refunded":
        ...  # mark refunded
    elif kind in ("payout.settled", "payout.partial", "payout.failed"):
        ...  # reconcile the batch — event["data"]["orderRef"] is your merchantBatchNo
    return {"ok": True}, 200

package main

import (
	"io"
	"net/http"
	"os"

	absolutepay "github.com/AbsolutePay/absolutepay-go"
)

func main() {
	secret := os.Getenv("ABSOLUTEPAY_WEBHOOK_SECRET")
	http.HandleFunc("/webhooks/absolutepay", func(w http.ResponseWriter, r *http.Request) {
		// 1. Verify (signature + freshness) on the RAW bytes — do not re-serialize.
		raw, _ := io.ReadAll(r.Body)
		event, err := absolutepay.ConstructEvent(raw, r.Header, secret)
		if err != nil { // errors.Is(err, absolutepay.ErrInvalidSignature)
			http.Error(w, "bad signature", http.StatusBadRequest)
			return
		}

		// 2. De-dupe on event.ID — deliveries are at-least-once. In production, back
		//    this with a unique index (INSERT … ON CONFLICT DO NOTHING) instead of memory.
		if !markProcessedOnce(event.ID) {
			w.WriteHeader(http.StatusOK)
			return
		}

		// 3. Ack fast, then do heavy work async (event.Data is json.RawMessage — unmarshal per type).
		w.WriteHeader(http.StatusOK)

		switch event.Type {
		case "payment.succeeded": // fulfill order — json.Unmarshal(event.Data, &…)
		case "payment.failed": // release cart / notify customer
		case "charge.refunded": // mark refunded
		case "payout.settled", "payout.partial", "payout.failed": // reconcile the batch
		}
	})
	http.ListenAndServe(":4242", nil)
}