Webhooks Reference

const express = require("express");
const crypto = require("crypto");

const app = express();

// Keep the raw body so the HMAC matches byte-for-byte.
app.post("/webhooks/rohopay",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const secret = process.env.ROHOPAY_WEBHOOK_SECRET; // from Dashboard → Webhooks
    const sig = req.get("X-RohoPay-Signature") || "";
    const expected = "sha256=" + crypto
      .createHmac("sha256", secret)
      .update(req.body) // raw Buffer
      .digest("hex");

    const a = Buffer.from(sig);
    const b = Buffer.from(expected);
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).send("Invalid signature");
    }

    const event = JSON.parse(req.body.toString());
    console.log("Webhook:", event.event, event.transaction_id, event.status);

    // Idempotent — RohoPay may retry, so guard on event.transaction_id.
    switch (event.event) {
      case "deposit.successful": /* credit your customer */ break;
      case "withdraw.failed":    /* notify / refund */      break;
    }

    res.json({ received: true }); // any 2xx stops retries
  }
);

app.listen(3000);

<?php
$payload = file_get_contents("php://input");          // raw body
$sig     = $_SERVER["HTTP_X_ROHOPAY_SIGNATURE"] ?? "";
$secret  = getenv("ROHOPAY_WEBHOOK_SECRET");          // from Dashboard → Webhooks

$expected = "sha256=" . hash_hmac("sha256", $payload, $secret);
if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit("Invalid signature");
}

$event = json_decode($payload, true);
// Idempotent — guard on $event["transaction_id"] (RohoPay may retry).
switch ($event["event"]) {
    case "deposit.successful": /* credit your customer */ break;
    case "withdraw.failed":    /* notify / refund */      break;
}

http_response_code(200);
echo json_encode(["received" => true]);