Webhooks

{
  "event": "transaction.payout_completed",
  "timestamp": "2025-06-15T10:30:00.000Z",
  "partnerId": "your_partner_id",
  "data": {
    // Event-specific payload
  }
}

{
  "event": "transaction.payout_completed",
  "timestamp": "2025-06-15T10:30:00.000Z",
  "partnerId": "ss_api_partner_production",
  "data": {
    "transactionId": "txn_1768722777_abc123",
    "merchant_id": "your_merchant_reference",
    "payoutId": "NKSHV2beTTiymZY64S1DWMcxYDP8",
    "orderId": "order_1768722781916_fa33d9127b22",
    "amount": 50000,
    "currency": "INR",
    "status": "SUCCESS",
    "utr": "601813168575",
    "provider": "TSP-1",
    "receiver_name": "JOHN DOE",
    "bank_account_masked": "9240****5350",
    "ifsc_code": "UTIB0005616",
    "completedAt": "2025-06-15T10:30:00.000Z",
    "message": "Payout completed successfully"
  }
}

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  // Parse: t=timestamp,v1=signature
  const [timestampPart, signaturePart] = signature.split(',');
  const timestamp = timestampPart.replace('t=', '');
  const receivedSig = signaturePart.replace('v1=', '');

  // Check timestamp (5 min tolerance)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    throw new Error('Webhook timestamp too old');
  }

  // Compute expected signature
  const message = `${timestamp}.${payload}`;
  const expectedSig = crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');

  // Compare
  if (!crypto.timingSafeEqual(
    Buffer.from(expectedSig),
    Buffer.from(receivedSig)
  )) {
    throw new Error('Invalid webhook signature');
  }

  return true;
}

// Express example
app.post('/webhooks/stablepay', (req, res) => {
  const signature = req.headers['x-stablepay-signature'];
  const payload = JSON.stringify(req.body);

  try {
    verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET);

    // Process webhook
    const { event, data } = req.body;
    handleWebhookEvent(event, data);

    res.status(200).json({ received: true });
  } catch (error) {
    res.status(401).json({ error: error.message });
  }
});

curl -X POST https://api.stablepay.global/v2/webhooks/{eventId}/retry \
  -H "Authorization: Bearer YOUR_API_KEY"