Overview

curl --request POST \
     --url https://<your-website>/<your-webhook-endpoint> \
     --header 'content-type: application/json' \
     --header 'x-wk-timestamp: 1711077773' \
     --header 'x-wk-signature: <webhook-signatures generated by UQPAY>' \
     --data '
              {
                "version": "V1.5.2",
                "event_type": "ISSUING",
                "event_name": "issuing.transaction.declined",
                "event_id": "8a78af1e-de83-43a5-b177-ecbc6a8a9fc6",
                "data": {
                    "card_id": "c0cef051-29c5-4796-b86a-cd5b684bfad7",
                    "card_number": "************5668",
                    "card_order_id": "c0cef051-29c5-4796-b86a-cd5ee34bfad7",
                    "transaction_id": "5135e6cc-28b6-4889-81dc-3b86a09e1395",
                    "transaction_type": "AUTHORIZATION",
                    "authorization_code": 856268,
                    "billing_amount": 70.25,
                    "billing_currency": "SGD",
                    "transaction_amount": 100.25,
                    "transaction_currency": "USD",
                    "transaction_time": "2024-01-11 18:40:10",
                    "posted_time": "2024-01-13 13:40:10",
                    "merchant_data": [
                      {
                        "category_code": 5734,
                        "city": "string",
                        "country": "string",
                        "name": "string"
                      }
                    ],
                    "failure_reason": "1107 - Invalid CVV2",
                    "transaction_status": "DECLINED"
                  }
              }
'

...
payload = "" //webhook payload
secret = '<YOUR_WEBHOOK_SECRET>'
timestamp := c.GetHeader("x-wk-timestamp")
signature := c.GetHeader("x-wk-signature")

valueToDigest := payload + timestamp
signatureHex := calculateHMACSHA512([]byte(secret), []byte(valueToDigest))

//compare signatureHex with signature
...

...
StringBuilder valueToDigest = new StringBuilder();

String payload = ""; //webhook payload

// Get the timestamp, signature from header
String timestamp = request.getHeader("x-wk-timestamp");
String signature = request.getHeader("x-wk-signature");

valueToDigest.append(payload);
valueToDigest.append(timestamp);

// Get your secret
String secret = getSecret();

String signatureHex = HmacUtils.hmacSha512Hex(secret, valueToDigest.toString())
...

<?php
...
  $timestamp = $request->getHeaderLine('x-wk-timestamp');
  $payload = $request->getBody()->getContents();

  $secret = <your signatuer secret>;
  $signature = $request->getHeaderLine('x-wk-signature');

  if (hash_hmac('sha512', $payload.$timestamp, $secret) != $signature) {
  	return new Response(400, array(), 'failed to verify the signature');
  }

  // Do something with event
  return new Response(200, array(), $body);
}

use ring::hmac;

fn verify_signature(payload: &str, timestamp: &str, received_signature: &str, secret: &str) -> bool {
    let key = hmac::Key::new(hmac::HMAC_SHA512, secret.as_bytes());
    let value_to_digest = format!("{}{}", payload, timestamp);
    let signature = hmac::sign(&key, value_to_digest.as_bytes());
    let signature_hex = hex::encode(signature.as_ref());

    signature_hex == received_signature
}

fn main() {
    let payload = ""; // Your webhook payload here
    let secret = "<YOUR_WEBHOOK_SECRET>";
    let timestamp = "x-wk-timestamp header value here";
    let received_signature = "x-wk-signature header value here";

    if verify_signature(payload, timestamp, received_signature, secret) {
        println!("Signature verified!");
    } else {
        println!("Signature verification failed!");
    }
}

// express.js
const crypto = require('crypto')

const secret = '<YOUR_WEBHOOK_SECRET>'

async webhookController(ctx, next) {
  // webhook is received

  const { headers, body } = ctx.request
  const { name, accountId } = body || {} // payload

  const timestamp = headers['x-wk-timestamp']

  const payload = `${body}${timestamp}`

  const signatureHex = crypto.createHmac('sha512', secret).update(payload).digest('hex')

  if (signatureHex === headers['x-wk-signature']) {
    // do business logic after signature is verified

    return next() // http response code = 200: ack the webhook
  } else {
    ctx.status = 500
    ctx.body = 'failed to verify webhook signature'
    return
  }
}