Webhooks Overview

const express = require('express');
const crypto = require('crypto');

const app = express();

app.post('/webhooks/daya-pro', express.raw({ type: 'application/json' }), (req, res) => {
  const signatureHeader = req.headers['x-webhook-signature'];
  const payload = req.body.toString('utf8');

  // 1. Verify signature (strip "sha256=" prefix)
  const signature = signatureHeader?.replace('sha256=', '');
  if (!verifySignature(payload, signature, process.env.DAYA_PRO_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // 2. Parse and check idempotency
  const event = JSON.parse(payload);
  if (isProcessed(event.event_id)) {
    return res.status(200).send('Already processed');
  }

  // 3. Handle event
  switch (event.type) {
    case 'order.filled':
      handleOrderFilled(event.data);
      break;
    case 'order.partially_filled':
      handlePartialFill(event.data);
      break;
    case 'trade.executed':
      handleTradeExecuted(event.data);
      break;
    case 'crypto.deposit.completed':
      handleCryptoDepositCompleted(event.data);
      break;
    // ... handle other events
  }

  markAsProcessed(event.event_id);
  res.status(200).send('OK');
});

function verifySignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

from flask import Flask, request, jsonify
import hmac
import hashlib

app = Flask(__name__)

@app.route('/webhooks/daya-pro', methods=['POST'])
def handle_webhook():
    signature_header = request.headers.get('X-Webhook-Signature', '')
    payload = request.get_data()

    # 1. Verify signature (strip "sha256=" prefix)
    signature = signature_header.replace('sha256=', '')
    if not verify_signature(payload, signature, DAYA_PRO_WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    # 2. Parse and check idempotency
    event = request.json
    if is_processed(event['event_id']):
        return jsonify({'status': 'already_processed'}), 200

    # 3. Handle event
    event_type = event['type']
    data = event['data']

    if event_type == 'order.filled':
        handle_order_filled(data)
    elif event_type == 'order.partially_filled':
        handle_partial_fill(data)
    elif event_type == 'trade.executed':
        handle_trade_executed(data)
    elif event_type == 'crypto.deposit.completed':
        handle_crypto_deposit_completed(data)

    mark_as_processed(event['event_id'])
    return jsonify({'status': 'ok'}), 200

def verify_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "io"
    "net/http"
    "strings"
)

func handleWebhook(w http.ResponseWriter, r *http.Request) {
    signatureHeader := r.Header.Get("X-Webhook-Signature")
    payload, _ := io.ReadAll(r.Body)

    // 1. Verify signature (strip "sha256=" prefix)
    signature := strings.TrimPrefix(signatureHeader, "sha256=")
    if !verifySignature(payload, signature, dayaProWebhookSecret) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    // 2. Parse event
    var event WebhookEvent
    json.Unmarshal(payload, &event)

    // 3. Check idempotency
    if isProcessed(event.EventID) {
        w.WriteHeader(http.StatusOK)
        return
    }

    // 4. Handle event
    switch event.Type {
    case "order.filled":
        handleOrderFilled(event.Data)
    case "order.partially_filled":
        handlePartialFill(event.Data)
    case "trade.executed":
        handleTradeExecuted(event.Data)
    case "crypto.deposit.completed":
        handleCryptoDepositCompleted(event.Data)
    }

    markAsProcessed(event.EventID)
    w.WriteHeader(http.StatusOK)
}

func verifySignature(payload []byte, signature string, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(payload)
    expectedSignature := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expectedSignature))
}