Webhooks

{
  "event": "payment.success",
  "type": "payment.paid",
  "order_id": "UPN-0123456789",
  "merchant_order_id": "order_1024",
  "amount": 499,
  "payable_amount": 499.07,
  "paid_at": "2026-09-08T17:26:01.000Z",
  "failed_at": null,
  "payer_email": "[email protected]",
  "attempt": 1
}

<?php
$secret = 'YOUR_WEBHOOK_SECRET';
$raw = file_get_contents('php://input');
$parts = [];
foreach (explode(',', $_SERVER['HTTP_X_SIGNATURE'] ?? '') as $pair) {
    [$k, $v] = array_pad(explode('=', $pair, 2), 2, '');
    $parts[trim($k)] = trim($v);
}
$t = $parts['t'] ?? '';
$v1 = $parts['v1'] ?? '';
$expected = hash_hmac('sha256', $t . '.' . $raw, $secret);
if ($t === '' || $v1 === '' || !hash_equals($expected, $v1)) {
    http_response_code(401);
    exit('invalid signature');
}
if (abs(time() - (int) $t) > 300) {
    http_response_code(400);
    exit('stale');
}
$event = json_decode($raw, true);
// "type" is the new name (payment.paid). "event" keeps the old one (payment.success).
if (($event['type'] ?? '') === 'payment.paid') {
    // Mark $event['merchant_order_id'] as paid in your database, only once.
}
// Log to the server's error log, never to a file inside the public web folder.
error_log('UPINOW webhook verified: ' . ($event['order_id'] ?? ''));
echo 'ok';

import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = "YOUR_WEBHOOK_SECRET";

createServer((req, res) => {
  let raw = "";
  req.on("data", (chunk) => (raw += chunk));
  req.on("end", () => {
    const parts = Object.fromEntries(
      String(req.headers["x-signature"] ?? "").split(",").map((p) => p.trim().split("=")),
    );
    const t = parts.t ?? "";
    const v1 = parts.v1 ?? "";
    const expected = createHmac("sha256", SECRET).update(t + "." + raw).digest("hex");
    // Check the shape first: timingSafeEqual throws (and would stop this server) on unequal lengths.
    const ok = t !== "" && /^[0-9a-f]{64}$/.test(v1) && timingSafeEqual(Buffer.from(v1, "hex"), Buffer.from(expected, "hex"));
    if (!ok) return res.writeHead(401).end("invalid signature");
    if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.writeHead(400).end("stale");
    const event = JSON.parse(raw);
    // "type" is the new name (payment.paid). "event" keeps the old one (payment.success).
    if (event.type === "payment.paid") {
      // Mark event.merchant_order_id as paid in your database, only once.
    }
    res.writeHead(200).end("ok");
  });
}).listen(8000);

import hashlib, hmac, json, time
from http.server import BaseHTTPRequestHandler, HTTPServer

SECRET = "YOUR_WEBHOOK_SECRET"

class Hook(BaseHTTPRequestHandler):
    def do_POST(self):
        raw = self.rfile.read(int(self.headers.get("Content-Length", 0)))
        parts = dict(p.strip().split("=", 1) for p in self.headers.get("X-Signature", "").split(",") if "=" in p)
        t, v1 = parts.get("t", ""), parts.get("v1", "")
        expected = hmac.new(SECRET.encode(), t.encode() + b"." + raw, hashlib.sha256).hexdigest()
        if not t or not hmac.compare_digest(expected.encode(), v1.encode()):
            self.send_response(401); self.end_headers(); return
        if abs(time.time() - int(t)) > 300:
            self.send_response(400); self.end_headers(); return
        event = json.loads(raw)
        # "type" is the new name (payment.paid). "event" keeps the old one (payment.success).
        if event.get("type") == "payment.paid":
            pass  # Mark event["merchant_order_id"] as paid in your database, only once.
        self.send_response(200); self.end_headers(); self.wfile.write(b"ok")

HTTPServer(("", 8000), Hook).serve_forever()