Webhooks

apx-signature: t=1783539464,v1=5f8a1c…

import { constructEvent } from '@apxrails/sdk-node';

app.post('/webhooks/apxrails', express.raw({ type: '*/*' }), (req, res) => {
  let event;
  try {
    event = constructEvent({
      payload: req.body,
      header: req.headers['apx-signature'],
      secret: process.env.APX_WEBHOOK_SECRET,
    });
  } catch {
    return res.status(401).end();
  }

  switch (event.type) {
    case 'checkout.session.completed': /* re-query, then fulfill */ break;
    case 'refund.succeeded':           /* update your order state */ break;
    case 'dispute.created':            /* alert someone — deadlines are real */ break;
  }
  res.status(200).end();
});

<?php
function apx_verify_webhook(string $payload, ?string $header, string $secret,
                            int $tolerance = 300): bool {
    if ($header === null) return false;
    $timestamp = null; $signatures = [];
    foreach (explode(',', $header) as $kv) {
        [$k, $v] = array_pad(explode('=', $kv, 2), 2, '');
        if (trim($k) === 't')  $timestamp = (int) trim($v);
        if (trim($k) === 'v1') $signatures[] = trim($v);
    }
    if (!$timestamp || !$signatures) return false;
    if (abs(time() - $timestamp) > $tolerance) return false;

    $expected = hash_hmac('sha256', $timestamp . '.' . $payload, $secret);
    foreach ($signatures as $sig) {
        if (hash_equals($expected, $sig)) return true;
    }
    return false;
}

$payload = file_get_contents('php://input');           // RAW body
$header  = $_SERVER['HTTP_APX_SIGNATURE'] ?? null;
if (!apx_verify_webhook($payload, $header, getenv('APX_WEBHOOK_SECRET'))) {
    http_response_code(401); exit;
}
$event = json_decode($payload, true);
http_response_code(200);