Webhook Integration

1{
2  "event": "payment.success",
3  "txn_id": "TXN202602150001",
4  "merchant_txn_id": "ORDER-12345",
5  "status": "SUCCESS",
6  "request_amount": 1500.00,
7  "paid_amount": 1500.00,
8  "currency": "INR",
9  "payment_mode": "UPI",
10  "bank_txn_id": "BANK123456789",
11  "bank_rrn": "432109876543",
12  "completed_at": "2026-02-15T10:30:00Z",
13  "timestamp": "2026-02-15T10:30:01.234Z",
14  "idempotency_key": "TXN202602150001_SUCCESS"
15}

1{
2  "event": "payment.failed",
3  "txn_id": "TXN202602150002",
4  "merchant_txn_id": "ORDER-12346",
5  "status": "FAILED",
6  "request_amount": 2000.00,
7  "paid_amount": null,
8  "currency": "INR",
9  "payment_mode": "NETBANKING",
10  "bank_txn_id": null,
11  "bank_rrn": null,
12  "completed_at": "2026-02-15T11:00:00Z",
13  "timestamp": "2026-02-15T11:00:00.567Z",
14  "idempotency_key": "TXN202602150002_FAILED"
15}

1{
2  "event": "payment.expired",
3  "txn_id": "TXN202602150003",
4  "merchant_txn_id": "ORDER-12347",
5  "status": "EXPIRED",
6  "request_amount": 500.00,
7  "paid_amount": null,
8  "currency": "INR",
9  "payment_mode": null,
10  "bank_txn_id": null,
11  "bank_rrn": null,
12  "completed_at": null,
13  "timestamp": "2026-02-15T11:30:00.789Z",
14  "idempotency_key": "TXN202602150003_EXPIRED"
15}

1{
2  "event": "payment.timeout",
3  "txn_id": "TXN202602150004",
4  "merchant_txn_id": "ORDER-12348",
5  "status": "TIMEOUT",
6  "request_amount": 3000.00,
7  "paid_amount": null,
8  "currency": "INR",
9  "payment_mode": "CARD",
10  "bank_txn_id": null,
11  "bank_rrn": null,
12  "completed_at": null,
13  "timestamp": "2026-02-15T12:00:00.123Z",
14  "idempotency_key": "TXN202602150004_TIMEOUT"
15}

1import javax.crypto.Mac;
2import javax.crypto.spec.SecretKeySpec;
3import java.nio.charset.StandardCharsets;
4import java.security.MessageDigest;
5import java.time.Instant;
6import java.util.Base64;
7import java.util.Map;
8
9import org.springframework.http.ResponseEntity;
10import org.springframework.web.bind.annotation.*;
11
12@RestController
13@RequestMapping("/webhooks/sabpaisa")
14public class SabPaisaWebhookController {
15
16    private static final String WEBHOOK_SECRET = "your_webhook_secret_key";
17
18    @PostMapping
19    public ResponseEntity<Map<String, String>> handleWebhook(
20            @RequestBody String rawBody,
21            @RequestHeader("X-SabPaisa-Signature") String signatureHeader,
22            @RequestHeader("X-SabPaisa-Event") String eventType) {
23
24        // Step 1: Verify signature
25        if (!verifySignature(rawBody, signatureHeader, WEBHOOK_SECRET)) {
26            return ResponseEntity.status(401)
27                    .body(Map.of("error", "Invalid signature"));
28        }
29
30        // Step 2: Parse and process (use async in production)
31        System.out.println("Received webhook: " + eventType);
32
33        // Step 3: Acknowledge
34        return ResponseEntity.ok(Map.of("status", "received"));
35    }
36
37    private boolean verifySignature(String rawBody, String signatureHeader, String secret) {
38        try {
39            String[] parts = signatureHeader.split("\\.");
40            if (parts.length != 2) return false;
41
42            long timestamp = Long.parseLong(parts[0]);
43            String receivedSignature = parts[1];
44
45            // Check timestamp freshness (5-minute tolerance)
46            long now = Instant.now().toEpochMilli();
47            if (Math.abs(now - timestamp) > 300000) return false;
48
49            // Compute expected signature
50            String toSign = timestamp + "." + rawBody;
51            Mac hmac = Mac.getInstance("HmacSHA256");
52            SecretKeySpec keySpec = new SecretKeySpec(
53                    secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
54            hmac.init(keySpec);
55            byte[] hash = hmac.doFinal(toSign.getBytes(StandardCharsets.UTF_8));
56            String expectedSignature = Base64.getEncoder().encodeToString(hash);
57
58            // Constant-time comparison
59            return MessageDigest.isEqual(
60                    expectedSignature.getBytes(StandardCharsets.UTF_8),
61                    receivedSignature.getBytes(StandardCharsets.UTF_8));
62        } catch (Exception e) {
63            return false;
64        }
65    }
66}

1<?php
2
3$webhookSecret = getenv('SABPAISA_WEBHOOK_SECRET');
4
5// Step 1: Read raw body
6$rawBody = file_get_contents('php://input');
7$signatureHeader = $_SERVER['HTTP_X_SABPAISA_SIGNATURE'] ?? '';
8
9// Step 2: Verify signature
10if (!verifySignature($rawBody, $signatureHeader, $webhookSecret)) {
11    http_response_code(401);
12    echo json_encode(['error' => 'Invalid signature']);
13    exit;
14}
15
16// Step 3: Parse payload
17$payload = json_decode($rawBody, true);
18
19// Step 4: Check idempotency
20$idempotencyKey = $payload['idempotency_key'];
21// if (isAlreadyProcessed($idempotencyKey)) {
22//     http_response_code(200);
23//     echo json_encode(['status' => 'already_processed']);
24//     exit;
25// }
26
27// Step 5: Process event
28switch ($payload['event']) {
29    case 'payment.success':
30        error_log("Payment SUCCESS: " . $payload['txn_id']);
31        break;
32    case 'payment.failed':
33        error_log("Payment FAILED: " . $payload['txn_id']);
34        break;
35    case 'payment.expired':
36        error_log("Payment EXPIRED: " . $payload['txn_id']);
37        break;
38    case 'payment.timeout':
39        error_log("Payment TIMEOUT: " . $payload['txn_id']);
40        break;
41}
42
43// Step 6: Acknowledge
44http_response_code(200);
45echo json_encode(['status' => 'received']);
46
47function verifySignature(string $rawBody, string $signatureHeader, string $secret): bool {
48    if (empty($signatureHeader)) return false;
49
50    $parts = explode('.', $signatureHeader, 2);
51    if (count($parts) !== 2) return false;
52
53    [$timestamp, $receivedSignature] = $parts;
54
55    // Check timestamp freshness (5-minute tolerance)
56    $now = round(microtime(true) * 1000);
57    if (abs($now - intval($timestamp)) > 300000) return false;
58
59    // Compute expected signature
60    $toSign = $timestamp . '.' . $rawBody;
61    $expectedSignature = base64_encode(
62        hash_hmac('sha256', $toSign, $secret, true)
63    );
64
65    // Constant-time comparison
66    return hash_equals($expectedSignature, $receivedSignature);
67}

1using System.Security.Cryptography;
2using System.Text;
3using Microsoft.AspNetCore.Mvc;
4
5[ApiController]
6[Route("webhooks/sabpaisa")]
7public class SabPaisaWebhookController : ControllerBase
8{
9    private const string WebhookSecret = "your_webhook_secret_key";
10
11    [HttpPost]
12    public IActionResult HandleWebhook(
13        [FromHeader(Name = "X-SabPaisa-Signature")] string signatureHeader)
14    {
15        // Read raw body
16        using var reader = new StreamReader(Request.Body, Encoding.UTF8);
17        var rawBody = reader.ReadToEndAsync().Result;
18
19        // Verify signature
20        if (!VerifySignature(rawBody, signatureHeader, WebhookSecret))
21            return Unauthorized(new { error = "Invalid signature" });
22
23        // Process webhook asynchronously...
24
25        return Ok(new { status = "received" });
26    }
27
28    private static bool VerifySignature(string rawBody, string signatureHeader, string secret)
29    {
30        var parts = signatureHeader.Split('.', 2);
31        if (parts.Length != 2) return false;
32
33        if (!long.TryParse(parts[0], out var timestamp)) return false;
34        var receivedSignature = parts[1];
35
36        // Check timestamp freshness
37        var now = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
38        if (Math.Abs(now - timestamp) > 300000) return false;
39
40        // Compute expected signature
41        var toSign = $"{timestamp}.{rawBody}";
42        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
43        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(toSign));
44        var expectedSignature = Convert.ToBase64String(hash);
45
46        // Constant-time comparison
47        return CryptographicOperations.FixedTimeEquals(
48            Encoding.UTF8.GetBytes(expectedSignature),
49            Encoding.UTF8.GetBytes(receivedSignature));
50    }
51}

1package main
2
3import (
4	"crypto/hmac"
5	"crypto/sha256"
6	"encoding/base64"
7	"encoding/json"
8	"fmt"
9	"io"
10	"math"
11	"net/http"
12	"strconv"
13	"strings"
14	"time"
15)
16
17const webhookSecret = "your_webhook_secret_key"
18
19func main() {
20	http.HandleFunc("/webhooks/sabpaisa", handleWebhook)
21	fmt.Println("Webhook server running on :3000")
22	http.ListenAndServe(":3000", nil)
23}
24
25func handleWebhook(w http.ResponseWriter, r *http.Request) {
26	// Read raw body
27	rawBody, err := io.ReadAll(r.Body)
28	if err != nil {
29		http.Error(w, "Failed to read body", http.StatusBadRequest)
30		return
31	}
32
33	// Verify signature
34	signatureHeader := r.Header.Get("X-SabPaisa-Signature")
35	if !verifySignature(string(rawBody), signatureHeader, webhookSecret) {
36		http.Error(w, `{"error":"Invalid signature"}`, http.StatusUnauthorized)
37		return
38	}
39
40	// Parse payload
41	var payload map[string]interface{}
42	json.Unmarshal(rawBody, &payload)
43
44	event := payload["event"].(string)
45	txnID := payload["txn_id"].(string)
46	fmt.Printf("Received %s for txn %s\n", event, txnID)
47
48	// Acknowledge
49	w.Header().Set("Content-Type", "application/json")
50	w.WriteHeader(http.StatusOK)
51	w.Write([]byte(`{"status":"received"}`))
52}
53
54func verifySignature(rawBody, signatureHeader, secret string) bool {
55	parts := strings.SplitN(signatureHeader, ".", 2)
56	if len(parts) != 2 {
57		return false
58	}
59
60	timestamp, err := strconv.ParseInt(parts[0], 10, 64)
61	if err != nil {
62		return false
63	}
64	receivedSignature := parts[1]
65
66	// Check timestamp freshness
67	now := time.Now().UnixMilli()
68	if math.Abs(float64(now-timestamp)) > 300000 {
69		return false
70	}
71
72	// Compute expected signature
73	toSign := fmt.Sprintf("%d.%s", timestamp, rawBody)
74	mac := hmac.New(sha256.New, []byte(secret))
75	mac.Write([]byte(toSign))
76	expectedSignature := base64.StdEncoding.EncodeToString(mac.Sum(nil))
77
78	// Constant-time comparison
79	return hmac.Equal([]byte(expectedSignature), []byte(receivedSignature))
80}