Webhooks

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_QUICKEI_SIGNATURE'] ?? '';

$expected = hash_hmac('sha256', $payload, $webhook_secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(403);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

if ($event['event'] === 'payout.completed') {
    // Mark payout as successful in your system
}

http_response_code(200);

const crypto = require('crypto');

app.post('/webhooks/quickei', (req, res) => {
  const payload = req.rawBody; // ensure raw body is available
  const signature = req.headers['x-quickei-signature'] || '';

  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  )) {
    return res.status(403).send('Invalid signature');
  }

  const event = JSON.parse(payload);

  if (event.event === 'payout.completed') {
    // Mark payout as successful
  }

  res.status(200).send('OK');
});

import hmac
import hashlib

@app.route('/webhooks/quickei', methods=['POST'])
def handle_webhook():
    payload = request.get_data(as_text=True)
    signature = request.headers.get('X-Quickei-Signature', '')

    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        return 'Invalid signature', 403

    event = request.get_json()

    if event['event'] == 'payout.completed':
        # Mark payout as successful
        pass

    return 'OK', 200