Verify Signatures

Always verify webhook signatures before processing payment events.

Verification endpoint

POST /api/v1/hesab/webhooks/verify-signature
Authorization: API-KEY your_api_key
Content-Type: application/json

Request

{
  "signature": "received_signature",
  "timestamp": "received_timestamp"
}

Node.js example

import axios from 'axios';

async function verifyWebhook(signature, timestamp) {
  const response = await axios.post(
    `${process.env.HESABPAY_API_URL}/api/v1/hesab/webhooks/verify-signature`,
    { signature, timestamp },
    {
      headers: {
        Authorization: `API-KEY ${process.env.HESABPAY_API_KEY}`,
        'Content-Type': 'application/json',
      },
    }
  );

  return response.data.success === true;
}

Processing rule

If verification fails, reject the webhook and do not update the order.