Webhooks

import { AgentaOS, WebhookVerificationError } from '@agentaos/pay';
import express from 'express';

const agentaos = new AgentaOS(process.env.AGENTAOS_API_KEY!);
const app = express();

// IMPORTANT: use express.raw() here. Verification signs the RAW body.
// If a JSON body parser runs first, the reserialized body won't match
// the signature and every event will fail verification.
app.post('/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = agentaos.webhooks.verify(
      req.body,
      req.headers['x-agentaos-signature'] as string,
      process.env.AGENTAOS_WEBHOOK_SECRET!,
    );
  } catch (err) {
    if (err instanceof WebhookVerificationError) {
      return res.status(400).send('Invalid signature');
    }
    return res.status(500).send('Webhook processing failed');
  }

  // Signature is valid: safe to act on event.data now.
  switch (event.type) {
    case 'checkout.session.completed':
      fulfillOrder(event.data.sessionId, event.data.amount);
      break;
    case 'send.completed':
      console.log('Send confirmed:', event.data.txHash);
      break;
    case 'send.failed':
      console.log('Send failed:', event.data.transactionId);
      break;
  }

  res.sendStatus(200);
});

import hmac, hashlib, time

def verify_webhook(body: str, signature: str, secret: str, tolerance_sec: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in signature.split(","))
    timestamp = int(parts["t"])

    # Reject old signatures (replay protection)
    if abs(time.time() - timestamp) > tolerance_sec:
        return False

    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.{body}".encode(),
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(expected, parts["v1"])

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"strconv"
	"strings"
	"time"
)

func verifyWebhook(body []byte, signature, secret string, toleranceSec int64) bool {
	parts := map[string]string{}
	for _, p := range strings.Split(signature, ",") {
		if kv := strings.SplitN(p, "=", 2); len(kv) == 2 {
			parts[kv[0]] = kv[1]
		}
	}
	timestamp, err := strconv.ParseInt(parts["t"], 10, 64)
	if err != nil || parts["v1"] == "" {
		return false
	}
	if age := time.Now().Unix() - timestamp; age > toleranceSec || age < 0 {
		return false // expired or in the future
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(fmt.Sprintf("%d.%s", timestamp, body)))
	expected := hex.EncodeToString(mac.Sum(nil))

	return hmac.Equal([]byte(expected), []byte(parts["v1"]))
}

<?php
function verify_webhook(string $body, string $signature, string $secret, int $toleranceSec = 300): bool {
    $parts = [];
    foreach (explode(',', $signature) as $pair) {
        [$key, $value] = array_pad(explode('=', $pair, 2), 2, null);
        $parts[$key] = $value;
    }
    $timestamp = (int) ($parts['t'] ?? 0);
    if (!$timestamp || empty($parts['v1'])) {
        return false;
    }
    if (abs(time() - $timestamp) > $toleranceSec) {
        return false; // expired
    }

    $expected = hash_hmac('sha256', "{$timestamp}.{$body}", $secret);
    return hash_equals($expected, $parts['v1']);
}