Webhooks Quick Start

const crypto = require('crypto');
const express = require('express');
const app = express();
 
app.post('/webhooks/payment', express.json(), async (req, res) => {
  // 1. Respond 200 immediately — prevents Exirom from retrying
  res.status(200).send('OK');
 
  // 2. Verify signature
  const received = req.headers['x-checksum'];
  const { paymentMethod } = req.query;
  const p = req.body;
 
  const raw = paymentMethod === 'apm'
    ? `${p.accountId}|${p.amount}|${p.currency}|${p.transactionId}`
    : `${p.mid}|${p.orderAmount}|${p.orderCurrency}|${p.transactionId}`;
 
  const expected = crypto
    .createHmac('sha256', process.env.MERCHANT_SECRET)
    .update(raw)
    .digest('base64');
 
  if (expected !== received) {
    console.error('Invalid signature — ignoring callback');
    return;
  }
 
  // 3. Deduplicate
  const key = `${p.transactionId}:${p.transactionStatus}`;
  const exists = await db.webhookLog.findUnique({ where: { key } });
  if (exists) return;
  await db.webhookLog.create({ data: { key } });
 
  // 4. Process
  if (p.transactionStatus === 'SUCCEED') {
    await fulfillOrder(p.transactionId);
  } else if (p.transactionStatus === 'FAILED') {
    await notifyCustomer(p.transactionId, p.declineCode);
  }
});