Webhooks

{
  "event": "payment.completed",
  "timestamp": "2024-01-15T12:05:30.000Z",
  "data": {
    "transactionId": "TX000007272",
    "status": "completed",
    "amount": 10000,
    "currency": "XOF",
    "fees": 150,
    "netAmount": 9850,
    "provider": "wave",
    "providerReference": "WAVE-TXN-123456",
    "externalReference": "COMMANDE-12345",
    "customerPhone": "+221771234567",
    "customerName": "Amadou Diallo",
    "paidAt": "2024-01-15T12:05:30.000Z",
    "metadata": {
      "orderId": "12345"
    }
  }
}

{
  "event": "payment.failed",
  "timestamp": "2024-01-15T12:02:00.000Z",
  "data": {
    "transactionId": "TX000007272",
    "status": "failed",
    "amount": 10000,
    "currency": "XOF",
    "provider": "wave",
    "externalReference": "COMMANDE-12345",
    "failureReason": "insufficient_funds",
    "failureMessage": "Solde insuffisant sur le compte Wave",
    "failedAt": "2024-01-15T12:02:00.000Z",
    "metadata": {
      "orderId": "12345"
    }
  }
}

{
  "event": "payout.completed",
  "timestamp": "2024-01-15T14:02:00.000Z",
  "data": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "payoutId": "PAY000001234",
    "externalRef": "PAY-2024-001",
    "status": "completed",
    "amount": 50000,
    "currency": "XOF",
    "fees": 250,
    "netAmount": 49750,
    "method": "mobile_money",
    "mobileNumber": "+221771234567",
    "mobileProvider": "wave",
    "providerReference": "WAVE-PAY-123456",
    "sourceBalanceCategory": "payout",
    "completedAt": "2024-01-15T14:02:00.000Z",
    "metadata": {
      "supplierId": "SUP-123"
    }
  }
}

{
  "event": "payout.failed",
  "timestamp": "2024-01-15T14:05:00.000Z",
  "data": {
    "id": "550e8400-e29b-41d4-a716-446655440001",
    "payoutId": "PAY000001235",
    "externalRef": "PAY-2024-003",
    "status": "failed",
    "amount": 100000,
    "currency": "XOF",
    "method": "mobile_money",
    "mobileNumber": "+221770000000",
    "mobileProvider": "wave",
    "errorCode": "invalid_recipient",
    "errorMessage": "Le numéro n'est pas associé à un compte Wave actif",
    "retryCount": 3,
    "maxRetries": 3
  }
}

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Dans votre handler Express
app.post('/webhooks/cauris', (req, res) => {
  const signature = req.headers['x-cauris-signature'];
  const isValid = verifyWebhook(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  // Répondre immédiatement
  res.status(200).send('OK');

  // Traiter en arrière-plan
  processWebhook(req.body);
});

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

function verifyWebhook($payload, $signature, $secret) {
    $expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);
    return hash_equals($expected, $signature);
}