Integrasikan pembayaran tanpa menebak.

{
  "event": "payment.success",
  "timestamp": "2026-10-25T02:15:30.412Z",
  "data": {
    "trx_id": "INV-2026-001",
    "qris_id": "cg4chpec",
    "amount": 25000,
    "customer_name": "Budi Santoso",
    "description": "Order #9912",
    "transaction": {
      "id": "01a17042-2ee0-7000-a4e3-2a145a499062",
      "order_id": "INV-2026-001",
      "amount": 25000,
      "issuer": "DANA",
      "payment_type": "DANA_QRIS",
      "transaction_time": "2026-10-25T02:15:10+07:00"
    }
  }
}

<?php
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$secret = 'WEBHOOK_SECRET_ANDA';

$expectedSignature = hash_hmac('sha256', $payload, $secret);

if (hash_equals($expectedSignature, $signature)) {
    $event = json_decode($payload, true);
    $trxId = $event['data']['trx_id'];
    
    // Update status pesanan di database toko Anda menjadi LUNAS:
    // updateOrderStatus($trxId, 'PAID');

    http_response_code(200);
    echo json_encode(['success' => true]);
} else {
    http_response_code(403);
    echo 'Tanda tangan webhook tidak valid';
}
?>

const crypto = require('crypto');

// 1. Tolak request lama (> 5 menit) untuk cegah replay attack
const ts = req.headers['x-webhook-timestamp'];
if (!ts || Math.abs(Date.now() - Number(ts)) > 300000) {
  return res.status(400).send('Request kedaluwarsa');
}

// 2. Cocokkan signature (wajib timing-safe)
const rawBody = req.rawBody; // siapkan body mentah, jangan parse JSON dulu
const secret = process.env.WEBHOOK_SECRET;
const expected = crypto.createHmac('sha256', secret)
  .update(rawBody).digest('hex');

if (!crypto.timingSafeEqual(
  Buffer.from(expected, 'hex'),
  Buffer.from(req.headers['x-webhook-signature'] || '', 'hex')
)) {
  return res.status(401).send('Signature tidak valid');
}

// 3. Payload sekarang aman diproses
const event = JSON.parse(rawBody);
markAsPaid(event.data.trx_id, event.data.amount);