Quickstart

import crypto from "crypto";

app.post("/webhooks/cryptocheckout",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const header = req.headers["x-webhook-signature"]; // "t=…,v1=…"
    const [tPart, vPart] = header.split(",");
    const timestamp = tPart.split("=")[1];
    const signature = vPart.split("=")[1];

    const expected = crypto
      .createHmac("sha256", process.env.CC_WEBHOOK_SECRET)
      .update(`${timestamp}.${req.body}`)
      .digest("hex");

    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
      return res.status(400).send("bad signature");
    }

    const event = JSON.parse(req.body);
    // Fulfil at capture. A pay-to-address payment also emits pool.swept
    // afterwards, so keep fulfilOrder idempotent per order.
    if (event.event === "pool.deposit.confirmed" || event.event === "pool.swept") {
      fulfilOrder(event.data);
    }
    res.sendStatus(200);
  });

import hmac, hashlib, os
from flask import request, abort

@app.post("/webhooks/cryptocheckout")
def webhook():
    header = request.headers["X-Webhook-Signature"]  # "t=…,v1=…"
    parts = dict(p.split("=", 1) for p in header.split(","))
    signed = f"{parts['t']}.{request.get_data(as_text=True)}"

    expected = hmac.new(
        os.environ["CC_WEBHOOK_SECRET"].encode(),
        signed.encode(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(parts["v1"], expected):
        abort(400)

    event = request.get_json()
    # Fulfil at capture. A pay-to-address payment also emits pool.swept
    # afterwards, so keep fulfil_order idempotent per order.
    if event["event"] in ("pool.deposit.confirmed", "pool.swept"):
        fulfil_order(event["data"])
    return "", 200