API Reference Documentation

<?php

function decryptPayload(string $encryptedBase64, string $secretKey): array 
{
    $raw = base64_decode($encryptedBase64);
    $iv = substr($raw, 0, 16);
    $cipherText = substr($raw, 16);
    
    $key = hash('sha256', $secretKey, true);
    $json = openssl_decrypt($cipherText, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
    
    return json_decode($json, true) ?? [];
}

$secretKey = "YOUR_SECRET_KEY";
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

$expectedSignature = hash_hmac('sha256', $rawBody, $secretKey);
if (!hash_equals($expectedSignature, $signature)) {
    http_response_code(401);
    exit("Invalid Webhook Signature!");
}

$payload = json_decode($rawBody, true);
$decryptedData = decryptPayload($payload['encrypted_data'], $secretKey);

$trxId = $decryptedData['trx_id'];
$amount = $decryptedData['amount'];
$status = $decryptedData['status'];

const crypto = require('crypto');

function decryptPayload(encryptedBase64, secretKey) {
    const raw = Buffer.from(encryptedBase64, 'base64');
    const iv = raw.subarray(0, 16);
    const cipherText = raw.subarray(16);
    
    const key = crypto.createHash('sha256').update(secretKey).digest();
    const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
    
    let decrypted = decipher.update(cipherText, null, 'utf8');
    decrypted += decipher.final('utf8');
    return JSON.parse(decrypted);
}

app.post('/api/webhook', (req, res) => {
    const secretKey = "YOUR_SECRET_KEY";
    const signature = req.headers['x-webhook-signature'];
    const rawBody = JSON.stringify(req.body);

    const expectedSignature = crypto.createHmac('sha256', secretKey).update(rawBody).digest('hex');
    if (signature !== expectedSignature) {
        return res.status(401).send("Invalid Webhook Signature!");
    }

    const decryptedData = decryptPayload(req.body.encrypted_data, secretKey);
    console.log("Verified Payment:", decryptedData.trx_id, decryptedData.status);

    res.status(200).send("OK");
});

import base64, hashlib, hmac, json
from Cryptodome.Cipher import AES

def decrypt_payload(encrypted_base64, secret_key):
    raw = base64.b64decode(encrypted_base64)
    iv = raw[:16]
    cipher_text = raw[16:]
    
    key = hashlib.sha256(secret_key.encode()).digest()
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted = cipher.decrypt(cipher_text)
    
    pad_len = decrypted[-1]
    json_str = decrypted[:-pad_len].decode('utf-8')
    return json.loads(json_str)

def verify_and_decrypt(raw_body_bytes, signature_header, secret_key):
    expected_sig = hmac.new(secret_key.encode(), raw_body_bytes, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected_sig, signature_header):
        raise ValueError("Invalid Webhook Signature!")
    
    payload = json.loads(raw_body_bytes.decode('utf-8'))
    return decrypt_payload(payload['encrypted_data'], secret_key)