Developer-first
payment API

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(signature, 'hex')
  );
}

// Express.js example
app.post('/webhooks/cevgate', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-cevgate-signature'];
  const secret = process.env.CEVGATE_WEBHOOK_SECRET;

  if (!verifyWebhookSignature(req.body, signature, secret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(req.body);

  switch (event.type) {
    case 'checkout.session.completed':
      // Fulfill the order
      fulfillOrder(event.data.metadata.order_id);
      break;
    case 'payment.failed':
      // Notify customer
      notifyPaymentFailure(event.data.customer_email);
      break;
  }

  res.status(200).json({ received: true });
});

import hmac
import hashlib

def verify_webhook_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# Flask example
@app.route('/webhooks/cevgate', methods=['POST'])
def handle_webhook():
    payload = request.get_data(as_text=True)
    signature = request.headers.get('X-CevGate-Signature')
    secret = os.environ['CEVGATE_WEBHOOK_SECRET']

    if not verify_webhook_signature(payload, signature, secret):
        return jsonify(error='Invalid signature'), 401

    event = request.get_json()
    # Process the event...
    return jsonify(received=True), 200