Webhook Signature Verification

All webhooks are signed with HMAC-SHA256. Verify the signature to ensure authenticity.

Headers sent with each webhook:

Header	Description
X-Webhook-Signature	HMAC-SHA256 signature of the payload
X-Webhook-Timestamp	ISO 8601 timestamp when webhook was sent

const crypto = require('crypto');

function verifyWebhook(payload, signature, webhookSecret) {
  const expectedSignature = crypto
    .createHmac('sha256', webhookSecret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// In your webhook handler
app.post('/webhooks/crypto', express.json(), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const payload = JSON.stringify(req.body);

  if (!verifyWebhook(payload, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Process webhook
  const { event, wallet, deposit, sweep, metadata } = req.body;

  switch (event) {
    case 'deposit.detected':
      console.log(`Deposit detected: ${deposit.amount} ${wallet.crypto}`);
      // Optionally show "payment pending" to user
      break;

    case 'deposit.confirmed':
      // Update your order status
      await updateOrder(metadata.orderId, {
        status: 'paid',
        txHash: deposit.txHash,
        amount: deposit.amount,
      });
      break;

    case 'sweep.completed':
      console.log(`Funds swept to your wallet: ${sweep.txHash}`);
      break;
  }

  res.status(200).send('OK');
});